mirror of
https://github.com/mattn/emmet-vim.git
synced 2026-06-14 11:39:41 +08:00
fbb61e7ef2
File paths passed to system() via xxd and identify were using manual double-quote wrapping instead of shellescape(), which could allow command injection with specially crafted filenames.