Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:neovim User: [email protected] Usertags: pu
[ Reason ] Neovim versions >= 0.9 added a vim.secure module to manage trust when automatically sourcing files from a directory. The vim.secure.read() API, used to read those files, was subject to command injection (CVE-2026-11487). This upload backports the patch to fix the CVE, with adjustments to make the test work in trixie's neovim version (thanks to Agatha Porte). [ Impact ] No-DSA CVE remains unfixed. [ Tests ] Upstream added an automated test to validate the fix. I've validated it fails before the fix. [ Risks ] Scope is limited to this API and has a test, so it is pretty targeted. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * Backport of CVE fix * Package metadata adjustments for first trixie upload (ci release, gbp config)
