Threats affecting pkg:github/neovim/neovim

Neovim versions 0.12.0 through 0.12.2 contain a command injection vulnerability in the M.read function within runtime/lua/vim/secure.lua. This flaw allows an attacker with local access to manipulate the path argument to execute arbitrary commands. A patch identified by commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf has been created to address this issue. The vulnerability has a medium severity rating with a CVSS score of 4.8.