Escaping a root directory with Windows device paths in Go's path/filepath
Go's path cleaner did not know that \??\c:\x is another spelling of c:\x, and the fix for that needed a fix of its own.
path-handling
Pointing Cargo's .cargo-ok write at a file outside the crate directory
Cargo wrote "ok" into a marker file after unpacking a crate, and the crate got to decide what that marker was.
found by Ori Hollander, JFrog Security Research
Arbitrary file write in node-tar through a stale directory cache
node-tar skipped a symlink check whenever its directory cache said the path was fine, and two ways of spelling a path could make the cache lie.
found by chen-robert, ginkoid and levpachmanov
Running commands from RDoc by starting a filename with a pipe
RDoc sniffed the first hundred bytes of any file called 'tags' to see whether it was a ctags index, and used the one Ruby function that treats a leading pipe as a command.
found by Alexandr Savca