I think there is fundamental design mistake when EDITOR string being badly escaped causing this bug It has one job * read file as priviledged user * copy it t

I think there is fundamental design mistake when EDITOR string being badly escaped causing this bug It has one job * read file as priviledged user * copy it to temporary file * run editor as unpriviledged user * copy the changed file back The fact lack of escaping somehow makes sudoedit try to edit file passed in EDITOR variable is extremely shoddy coding.