From cbc11e4d9591e1fa47fb9d8711b18b74d625746e Mon Sep 17 00:00:00 2001
From: Junegunn Choi <junegunn.c@gmail.com>
Date: Wed, 16 Sep 2026 09:42:54 +0900
Subject: [PATCH] completion(zsh): use private mktemp dir for completion FIFO

FIFO path was predictable (${TMPDIR:-/tmp}/fzf-complete-fifo-$$) and
_fzf_feed_fifo ignored rm/mkfifo failures, so on a shared /tmp another
user could pre-create the path (symlink or FIFO) and have the victim's
redirect follow it.

Allocate the FIFO inside a per-invocation mktemp -d directory, check
mkfifo status, and clean up the directory instead of the bare path.

Reported-by: sb24CK (https://github.com/sb24CK)
---
 CHANGELOG.md         | 2 ++
 shell/completion.zsh | 9 +++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb8853c3..1474b8db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,8 @@ CHANGELOG
     - On tmux 3.7, the window is still unzoomed, as tmux 3.7b crashes when a floating pane is created over a zoomed window
 - Security fixes
     - fzf-tmux no longer evaluates an attached layout size (e.g. `-l50`) via bash arithmetic, which could run commands or inject tmux flags (GHSA-w6x2-f5m4-xw82)
+    - zsh completion now creates its FIFO in a private `mktemp -d` directory instead of a predictable `/tmp` path (GHSA-7rj6-7pqx-v7rm)
+    - Reported by Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K (Researchers) of Innspark Solutions
 
 0.74.4
 ------
diff --git a/shell/completion.zsh b/shell/completion.zsh
index 3415812f..430793db 100644
--- a/shell/completion.zsh
+++ b/shell/completion.zsh
@@ -215,7 +215,7 @@ _fzf_dir_completion() {
 
 _fzf_feed_fifo() {
   command rm -f "$1"
-  mkfifo "$1"
+  command mkfifo "$1" || return
   cat <&0 > "$1" &|
 }
 
@@ -242,8 +242,9 @@ _fzf_complete() {
     rest=("$@")
   fi
 
-  local fifo lbuf matches post
-  fifo="${TMPDIR:-/tmp}/fzf-complete-fifo-$$"
+  local fifo fifo_dir lbuf matches post
+  fifo_dir=$(command mktemp -d "${TMPDIR:-/tmp}/fzf-completion-XXXXXX") || return
+  fifo="$fifo_dir/fifo"
   lbuf=${rest[0]}
   post="${funcstack[1]}_post"
   type $post > /dev/null 2>&1 || post=cat
@@ -256,7 +257,7 @@ _fzf_complete() {
   if [ -n "$matches" ]; then
     LBUFFER="$lbuf$matches"
   fi
-  command rm -f "$fifo"
+  command rm -rf "$fifo_dir"
 }
 
 # To use custom hostname lists, override __fzf_list_hosts.