Don't use formatted output in WCMD_setshow_sortenv.
Don't use unsafe vsprintf in WCMD_output.
diff --git a/programs/wcmd/builtins.c b/programs/wcmd/builtins.c
index 0d1a259..394a9bc 100644
--- a/programs/wcmd/builtins.c
+++ b/programs/wcmd/builtins.c
@@ -792,8 +792,10 @@
   qsort( str, count, sizeof (char*), WCMD_compare );
 
   /* print it */
-  for( i=0; i<count; i++ )
-    WCMD_output("%s\n", str[i] );
+  for( i=0; i<count; i++ ) {
+      WCMD_output_asis(str[i]);
+      WCMD_output_asis("\n");
+  }
 
   LocalFree( str );
 }