Source: aegisub Version: 3.4.2+ds-5 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerability was published for aegisub. CVE-2026-92705[0]: | Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to | 3.4.2, Aegisub automatically loads Automation scripts referenced by | `Automation Scripts` metadata in `ASS` subtitle projects without | asking whether the user trusts the scripts or their authors. An | attacker can distribute a crafted `ASS` file together with a | referenced malicious Automation script, and opening the `AS` file | executes arbitrary code with the privileges of the Aegisub process. | From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` | characters between extension validation and filesystem operations | additionally allows a crafted `ASS/Lua` polyglot to reference and | execute itself as a single-file variant. The vulnerability is fixed | in Aegisub 3.5.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92705 https://www.cve.org/CVERecord?id=CVE-2026-92705 [1] https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
