Cline patches a Windows binary-planting hole where a repo containing rg.exe ran instead of ripgrep

GitHub·high signalXBlueskyLinkedInCopy link

Cline v4.1.19 (published 2026-09-17T07:51Z) fixes opening a repository that contains a file named `rg.exe`, `git.exe` or `powershell.exe` running that file in place of the real program. Bare program names were resolved through the workspace directory before PATH, so a planted executable ran with the user's privileges as soon as the workspace was indexed. Cline now sets Windows' `NoDefaultCurrentDirectoryInExePath` opt-out at startup in both the VS Code extension and the JetBrains core, and child processes inherit it, so a program in the current directory needs `.\` inside Command Prompt as it already did in PowerShell.