I often work on Windows, so need to use MiKTeX. I recently found the minted package, which needs to call the external command pygmentize. I currently call xelatex with the -shell-escape option to support this, but I'd rather not give malicious latex files complete access to my system. TeXLive has the --restricted-shell-escape option, which is what I want, but it doesn't seem to be available on MiKTeX. I did find a passing reference to --shell-restricted, but I don't know if that's what I want, and if it is what I want I don't know how to use it.

Is --shell-restricted a way to tell XeLaTeX to run pygmentize but not del /F /S /Q C:\*.*? If so, how do I use it? If not, is there such a way and how do I use it? If you can, could you also link me to the official documentation on the subject?

  • Well miktex installs a documentation on your system. And it mentions --restrict-write18. --shell-restricted could work too - miktex often has alias names for some commands. Restricted write18 is enabled by default, but I don't know if your command is in the list of secure commands. Feb 13, 2013 at 18:27
  • 1
    The minted package explicitly checks if \pdfshellescape equals 1, so you'd have to change the package, even if you succeed into putting pygmentize ampng the allowed programs for restricted shell escape.
    – egreg
    Feb 13, 2013 at 20:23
  • I could always edit my local copy of the package to change the 1 into a 2 (or better yet, find a way to check if pygmentize is specifically available). That still leaves the problem of making it available. Now that I realize that \write18 is the method of accessing external commands, I can check its documentation and see if I find something.
    – Daniel H
    Feb 17, 2013 at 23:51

1 Answer 1


MiKTeX includes the option --restrict-write18 to allow a restricted set of commands to be run: this is enabled by default with an up-to-date MiKTeX. However, to allow this to work with minted there are two additional issues. First, you need to add pygmentize to the list of allowed commands: a separate question on this (probably for the 'general case') would be best. Secondly, minted checks for fully-enabled \write18 before it will even run: circumventing this would require a modified version of the package or a request to the package author to change the code.

As an aside, TeX Live runs fine on Windows, but of course you'd still have to deal with the two caveats.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.