Created attachment 527512 [details, diff] urxvt-filter-control-chars.patch URxvt allows pasting arbitrary characters, ie characters which might include ESC (or backspace and so on). So, it's possible to paste specially crafted text from a browser into vim (running inside rxvt) -- and by doing so, switch vim to command mode and run arbitrary shell commands (vim is not the only target). For PoC and further details see the URL. VTE library had the same problem and it was fixed [1] by filtering out some unwanted characters from paste buffer. I've prepared a similar patch for rxvt-unicode (attached) -- the filtering is disabled by default and can be enabled by using xresource setting: `urxvt.filterPastedControls: 1`. [1] https://bugzilla.gnome.org/show_bug.cgi?id=753197
