Hi, As Bookworm is on LTS support, I'm sending here instead of filing a stable update bug.
I've prepared aegisub 3.2.2+dfsg-7+deb12u1 for fixing CVE-2026-92705[1]. The patch is identical to the one in Bug#1152762[2]. I have manually tested that .ass subtitle file referencing a Lua automation script will trigger a dialog prompt to notify user about the fact, and let user choose whether to load the script. The path is mostly localized with some general input sanitation and hence low risk of breaking things IMHO. Let me know if you need more info. Hope to be able to fix this in Bookworm. [1] https://security-tracker.debian.org/tracker/CVE-2026-92705 [2] https://bugs.debian.org/1152762 -- Regards, Xiyue Deng
signature.asc
Description: PGP signature
