diff --git a/.srcoption b/.srcoption
index 21252f8f..27280f60 100644
--- a/.srcoption
+++ b/.srcoption
@@ -3,6 +3,7 @@
 --exclude=./?.sh
 --exclude=./test/install
 --exclude=./ble.sh
+--exclude=./gh[0-9][0-9][0-9][0-9]{,.*}
 GNUmakefile
 ble.pp
 blerc.template
diff --git a/docs/ChangeLog.md b/docs/ChangeLog.md
index e962b813..4c84576d 100644
--- a/docs/ChangeLog.md
+++ b/docs/ChangeLog.md
@@ -20,7 +20,7 @@
     - progcomp: fix a bug that `x` at the end of the last completion is trimmed `#D2308` xxxxxxxx
   - main: fix attach failure with `--attach=prompt` in Bash 5.3 POSIX mode `#D2267` 49845707
     - syntax: fix a problem that `$_` is not preserved `#D2269` e053690d
-  - keymap/vi: support bash-5.3 readline bindable function `bash-vi-complete` in `vi_nmap` `#D2305` xxxxxxxx
+  - keymap/vi: support bash-5.3 readline bindable function `bash-vi-complete` in `vi_nmap` `#D2305` 55e0ee71
 - bgproc: support opts `kill9-timeout=TIMEOUT` `#D2034` 3ab41652
 - progcomp(cd): change display name and support mandb desc (requested by EmilySeville7cfg) `#D2039` 74402098
 - cmdspec: add completion options for builtins (motivated by EmilySeville7cfg) `#D2040` 9bd24691
@@ -71,10 +71,10 @@
 - complete: support completion for `execute-named-command` `#D2288` 4fee44e6
 - complete: support `ble-face menu_complete_{match,selected}` (requested by simonLeary42) `#D2291` 31f264ad
 - edit: support `bleopt history_default_point={preserve,begin,end,near,far,{beginning,end}-of-line,preserve-column,...}` (requested by miltieIV2) `#D2297` 37291ff1
-- edit: support `bleopt undo_point={first,last,near,auto}` `#D2303` xxxxxxxx
-- keymap/vi: add readline-compatible widgets for `vi_imap` and `vi_nmap` (requested by excited-bore) `#D2304` xxxxxxxx
-- edit: support bash-5.2 readline bindable function `vi-edit-and-execute-command` `#D2306` xxxxxxxx
-- edit: support readline bindable function `paste-from-buffer` in more environments `#D2307` xxxxxxxx
+- edit: support `bleopt undo_point={first,last,near,auto}` `#D2303` 99af0ece
+- keymap/vi: add readline-compatible widgets for `vi_imap` and `vi_nmap` (requested by excited-bore) `#D2304` d7ec488a
+- edit: support bash-5.2 readline bindable function `vi-edit-and-execute-command` `#D2306` c395eb33
+- edit: support readline bindable function `paste-from-clipboard` in more environments `#D2307` 17646524
 
 ## Changes
 
@@ -101,7 +101,7 @@
 - complete: attempt pathname expansions of incomplete pattern for `COMPV` (reported by mcepl) `#D2278` 6a426954
 - make: save commit id and branch name with `git archive` (requested by LecrisUT, blackteahamburger) `#D2290` 31f264ad
 - edit: revert edits with widget `discard-line` (reported by dezza) `#D2301` 3b2b4b81
-- vi_nmap: fix cursor position after <kbd>C-o</kbd> `#D2302` xxxxxxxx
+- vi_nmap: fix cursor position after <kbd>C-o</kbd> `#D2302` c106239a
 
 ## Fixes
 
@@ -299,6 +299,7 @@
 - global: normalize quoting of function names of the form `prefix:$name` `#D2296` 3d7c98bb
 - global: use `[:blank:]` instead of `[:space:]` `#D2299` e2fd8f0f
 - global: rename `ret` not used as `REPLY` `#D2300` 86cbf78e
+- global: avoid raw word splitting `#D2309` xxxxxxxx
 
 <!---------------------------------------------------------------------------->
 # ble-0.4.0-devel3
diff --git a/note.txt b/note.txt
index 5998a453..941930be 100644
--- a/note.txt
+++ b/note.txt
@@ -7730,6 +7730,11 @@ bash_tips
 
 2024-12-30
 
+  * global: avoid raw word splitting [#D2309]
+
+    未だ $bytes 等の様に quote されていない箇所があって気になるので、
+    "ble/string#split-words" や "ble/util/assign-words" を使う様に修正する。
+
   * progcomp: fix a bug that "x" at the end of the last completion is trimmed [#D2308]
 
     l ~/.opt/tilix を補完しようとすると何故か "~/.opt/tili " になってしまう。色々
diff --git a/src/decode.sh b/src/decode.sh
index 7a5fb802..2f65695b 100644
--- a/src/decode.sh
+++ b/src/decode.sh
@@ -1330,7 +1330,9 @@ function ble-decode-char/.getent {
   if [[ $csistat && ! ${ent%_} ]]; then
     if ((csistat==_ble_decode_KCODE_ERROR)); then
       if [[ $bleopt_decode_error_cseq_vbell ]]; then
-        local ret; ble-decode-unkbd ${_ble_decode_char2_seq//_/ } $char
+        local ret
+        ble/string#split ret "${_ble_decode_char2_seq//_/ } $char"
+        ble-decode-unkbd "${ret[@]}"
         ble/term/visible-bell "unrecognized CSI sequence: $ret"
       fi
       [[ $bleopt_decode_error_cseq_abell ]] && ble/term/audible-bell
@@ -4178,13 +4180,13 @@ function ble/builtin/bind/.process {
         [[ -s "$_ble_base_run/$$.bind.save" ]] &&
           source "$_ble_base_run/$$.bind.save"
         [[ $opt_print ]] &&
-          builtin bind ${opt_keymap:+-m $opt_keymap} -$opt_print
+          builtin bind ${opt_keymap:+-m "$opt_keymap"} -"$opt_print"
         declare rlfunc
         for rlfunc in "${opt_queries[@]}"; do
-          builtin bind ${opt_keymap:+-m $opt_keymap} -q "$rlfunc"
+          builtin bind ${opt_keymap:+-m "$opt_keymap"} -q "$rlfunc"
         done )
     elif [[ $opt_print ]]; then
-      builtin bind ${opt_keymap:+-m $opt_keymap} -$opt_print
+      builtin bind ${opt_keymap:+-m "$opt_keymap"} -"$opt_print"
     fi
   fi
 
diff --git a/src/edit.sh b/src/edit.sh
index 908b3557..6bf200f9 100644
--- a/src/edit.sh
+++ b/src/edit.sh
@@ -11597,7 +11597,8 @@ if [[ $bleopt_internal_suppress_bash_output ]]; then
         local content cmd
         ble/util/readfile content "$file"
         >| "$file"
-        for cmd in $content; do
+        ble/string#split-words content "$content"
+        for cmd in "${content[@]}"; do
           case $cmd in
           (eof)
             # C-d
diff --git a/src/util.sh b/src/util.sh
index 35f4b27a..0c8d54aa 100644
--- a/src/util.sh
+++ b/src/util.sh
@@ -4016,7 +4016,7 @@ else
       local fmt=$3 time=$4
       ble/util/assign "$2" "ble/bin/date +\"\$fmt\" $time"
     else
-      ble/bin/date +"$1" $2
+      ble/bin/date +"$1" ${2+"$2"}
     fi
   }
 fi
@@ -7716,14 +7716,14 @@ else
     fi
 
     local bytes byte
-    ble/util/assign bytes '
+    ble/util/assign-words bytes '
       local IFS=
       while ble/bash/read -n 1 byte; do
         builtin printf "%d " "'\''$byte"
       done <<< "$s"
       IFS=$_ble_term_IFS
     '
-    ble/encoding:"$bleopt_input_encoding"/b2c $bytes
+    ble/encoding:"$bleopt_input_encoding"/b2c "${bytes[@]}"
   }
 fi