From be7f4cb62fe4ef35e5f4f107a11356385d0c7d1f Mon Sep 17 00:00:00 2001
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Thu, 23 Jul 2026 19:13:15 +0000
Subject: [PATCH] patch 9.2.0839: [security]: arbitrary code execution via
 keyword lookup

Problem:  [security]: arbitrary code execution via keyword lookup in
          sh.vim, zsh.vim and ps1.vim filetype plugin
          (manus-use)
Solution: For powershell, quote the commands using single quotes, for
          sh/zsh pass the argument as a separate list item to term_start()/system()
          (Yasuhiro Matsumoto).

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 runtime/ftplugin/ps1.vim | 5 +++--
 runtime/ftplugin/sh.vim  | 4 ++--
 runtime/ftplugin/zsh.vim | 6 +++---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/runtime/ftplugin/ps1.vim b/runtime/ftplugin/ps1.vim
index d6ab01016..79e545eb5 100644
--- a/runtime/ftplugin/ps1.vim
+++ b/runtime/ftplugin/ps1.vim
@@ -4,6 +4,7 @@
 " Last Change: 2021 Apr 02
 "              2024 Jan 14 by Vim Project (browsefilter)
 
+
 " Only do this when not done yet for this buffer
 if exists("b:did_ftplugin") | finish | endif
 
@@ -49,9 +50,9 @@ if exists('s:pwsh_cmd')
     " For exclusion of ConEmu, see https://github.com/Maximus5/ConEmu/issues/2048
     command! -buffer -nargs=1 GetHelp silent exe '!' . s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full "<args>" | ' . (has('unix') ? 'LESS= less' : 'less') | redraw!
   elseif has('terminal')
-    command! -buffer -nargs=1 GetHelp silent exe 'term ' . s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full "<args>"' . (executable('less') ? ' | less' : '')
+    command! -buffer -nargs=1 GetHelp call term_start([s:pwsh_cmd, '-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'RemoteSigned', '-Command', "Get-Help -Full '" . substitute(<q-args>, "'", "''", 'g') . "'" . (executable('less') ? ' | less' : '')])
   else
-    command! -buffer -nargs=1 GetHelp echo system(s:pwsh_cmd . ' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -Command Get-Help -Full <args>')
+    command! -buffer -nargs=1 GetHelp echo system([s:pwsh_cmd, '-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'RemoteSigned', '-Command', "Get-Help -Full '" . substitute(<q-args>, "'", "''", 'g') . "'"])
   endif
 endif
 setlocal keywordprg=:GetHelp
diff --git a/runtime/ftplugin/sh.vim b/runtime/ftplugin/sh.vim
index fccfe4be9..e303847f1 100644
--- a/runtime/ftplugin/sh.vim
+++ b/runtime/ftplugin/sh.vim
@@ -48,9 +48,9 @@ if get(b:, "is_bash", 0)
   if !has("gui_running") && executable("less")
     command! -buffer -nargs=1 ShKeywordPrg silent exe '!bash -c "{ help "<args>" 2>/dev/null || man "<args>"; } | LESS= less"' | redraw!
   elseif has("terminal")
-    command! -buffer -nargs=1 ShKeywordPrg silent exe ':term bash -c "help "<args>" 2>/dev/null || man "<args>""'
+    command! -buffer -nargs=1 ShKeywordPrg call term_start(['bash', '-c', 'help "$1" 2>/dev/null || man "$1"', '--', <q-args>])
   else
-    command! -buffer -nargs=1 ShKeywordPrg echo system('bash -c "help <args>" 2>/dev/null || man "<args>"')
+    command! -buffer -nargs=1 ShKeywordPrg echo system(['bash', '-c', 'help "$1" 2>/dev/null || MANPAGER= man "$1"', '--', <q-args>])
   endif
   setlocal keywordprg=:ShKeywordPrg
   let b:undo_ftplugin ..= " | setl kp< | sil! delc -buffer ShKeywordPrg"
diff --git a/runtime/ftplugin/zsh.vim b/runtime/ftplugin/zsh.vim
index 40986fccb..1a39a7bf7 100644
--- a/runtime/ftplugin/zsh.vim
+++ b/runtime/ftplugin/zsh.vim
@@ -22,9 +22,9 @@ if executable('zsh') && &shell !~# '/\%(nologin\|false\)$'
   if !has('gui_running') && executable('less')
     command! -buffer -nargs=1 ZshKeywordPrg silent exe '!MANPAGER= zsh -c "autoload -Uz run-help; run-help <args> 2>/dev/null | LESS= less"' | redraw!
   elseif has('terminal')
-    command! -buffer -nargs=1 ZshKeywordPrg silent exe ':term zsh -c "autoload -Uz run-help; run-help <args>"'
-  else
-    command! -buffer -nargs=1 ZshKeywordPrg echo system('zsh -c "autoload -Uz run-help; run-help <args> 2>/dev/null"')
+    command! -buffer -nargs=1 ZshKeywordPrg call term_start(['zsh', '-c', 'autoload -Uz run-help; run-help "$1"', '--', <q-args>])
+  elseif has("patch-9.2.0250")
+    command! -buffer -nargs=1 ZshKeywordPrg echo system(['zsh', '-c', 'autoload -Uz run-help; MANPAGER= run-help "$1" 2>/dev/null', '--', <q-args>])
   endif
   if !exists('current_compiler')
     compiler zsh