@@ -0,0 +1,8 @@
+---
+"@simple-git/argv-parser": patch
+"simple-git": patch
+---
+
+Add `VISUAL` environment variable to set of `allowUnsafeEditor` environment variables.
+
+Thanks to @oss-security-shopify for identifying the vulnerability.
@@ -9,13 +9,14 @@
   - Adds support for TypeScript declaration maps
   - Exports the `isGitEnvKey` helper to detect whether an environment variable can be used to configure a `git` operation
 
-  - Adds detection for `includeIf.<condition>.path`, thanks to @NotAFlightRisk for identifying the vulnerability
+  - Adds detection for `includeIf.<condition>.path`, thanks to @bhaswanthc, @NotAFlightRisk, @oss-security-shopify for identifying the vulnerability
 
 ### Patch Changes
 
 - c427fba: Additional argument parser vulnerability checks:
-  - Thanks to @mrillicit for identifying `include.path`, `filter.*.process`
+  - Thanks to @bhaswanthc, @mrillicit, @avrlab233, @avrlab233 for identifying `include.path`, `filter.*.process`
   - Thanks to @tejas619 for identifying `url.*.insteadOf`
+
 - 1bb14df: Vulnerability detection expanded to include `pager.*`, `uploadpack.packObjectsHook`, `difftool.*.cmd` and use of the `GIT_CONFIG_PARAMETERS` environment variable
 
   Thanks to @threalwinky and @nuc13us for identifying.
 
@@ -22,6 +22,7 @@ const GitEnvKeys = {
    'pager': 'allowUnsafePager',
    'prefix': 'allowUnsafeConfigPaths',
    'ssh_askpass': 'allowUnsafeAskPass',
+   'visual': 'allowUnsafeEditor',
 } as const satisfies Record<string, VulnerabilityCategory>;
 
 type GitEnv = Record<string, string> & {
 
@@ -37,6 +37,9 @@
   // v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
   git.raw("fetch", "--config=user.name=me", "...");
   ```
+  Thanks to @anir0y, @CFionaBF, @Leeziao, @internetteletubbie, @idisdi, @the-vibe-dev,
+  @D7EAD, @dellalibera, @gdegrange, @bilguunbicktivism, @cruzryan, @b1ue0ceanRun, @oss-security-shopify
+  for identifying the vulnerability.
 
   - Ambient environment variables are filtered before passing into the `git` child process.
 
 
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { exists, FILE } from '@kwsites/file-exists';
+import { promiseError } from '@kwsites/promise-result';
+import { assertGitError, createTestContext, newSimpleGit, setUpInit } from '@simple-git/test-utils';
+
+describe('--exec-path', () => {
+   it('blocks: use of VISUAL blocked by default', async () => {
+      const context = await createTestContext();
+      const root = await context.dir('poc-workdir');
+      const pwnd = context.path('new-exec-path-pwned');
+
+      await setUpInit({ git: newSimpleGit(root) });
+      await context.file(['poc-workdir', 'file']);
+      await newSimpleGit(root).raw('add', '.');
+      await newSimpleGit(root).raw('commit', '-m', 'foo');
+
+      const err = await promiseError(
+         newSimpleGit(root)
+            .env({ VISUAL: `touch ${pwnd}` })
+            .raw('commit', '--ammend')
+      );
+
+      expect(exists(pwnd, FILE)).toBe(false);
+
+      assertGitError(err, 'allowUnsafeEditor');
+   });
+});