Nischoy — vim Verification Results

Shell Special Character Set Must Escape Newline

🌳 tree-sitter VERIFIED

Function: mch_expand_wildcards · Z3 solved in 1.5ms

CVE-2026-33412 class: shell-bound glob expansion must escape line separators (at least newline) in metacharacter sets. This catches sibling command-injection variants where common shell metacharacters are escaped but line-separator delimiters are omitted.

View SMT2 Constraints

; benchmark generated from python API
(set-info :status unknown)
(declare-fun newline_escaped () Int)
(assert
 (<= newline_escaped 1))
(assert
 (>= newline_escaped 1))
(assert
 (and (distinct newline_escaped 1) true))
(check-sat)