Vim/Neovim Arbitrary Code Execution via Modelines
I feel like security for CLI users is generally falling behind other systems.<p>On Android and iOS, any application is supposedly running in its own sandbox, where it can&#x27;t just randomly access files used by the rest of the system (including other applications).<p>The web is obviously strongly based around a security model where a website ultimately can&#x27;t do much in terms of information access (eg, a properly designed website&#x27;s information is protected from other websites) .. as I understand it, this was not always the case (we&#x27;re not using ActiveX anymore, right?).<p>In the desktop space, this pattern is supposedly supported by Flatpak, and I think the macOS store (though I&#x27;m not sure about this—I haven&#x27;t actually used either).<p>Meanwhile, when a random developer decides to run `make` or `npm install` or `mvn install` or even `vim foo.txt`, they&#x27;re essentially trusting their entire computer to whoever created the content in their working directory.<p>Will there be some revolution at some point that encourages people to somehow isolate their commandline activities to different realms, thus limiting the scope of any attack like this?