CVE-2018-20969 — do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a !

Matched remediation archetype

Command, code, expression, and template injection

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Trace untrusted values to process execution, interpreters, evaluators, template engines, dynamic imports, and administrative scripting features.
• Determine whether the affected path is reachable across each trust boundary and which service account or host privilege it inherits.
• Review configuration for optional execution features, unsafe compatibility modes, and shell invocation.

Remediate safely

• Replace string-built commands or evaluated code with fixed operations and structured argument APIs that do not invoke a shell.
• Use strict allowlists for operation identifiers and reject unexpected input before it reaches any interpreter.
• Update the affected component and add inert regression tests covering metacharacters, encoding variants, and alternate request paths.