December 2025 - Aur-requests - lists.archlinux.org

[PRQ#78624] Orphan Request for ninja-fuchsia-git
by notify＠aur.archlinux.org 13 Jan '26

13 Jan '26

micwoj92 [1] filed an orphan request for ninja-fuchsia-git [2]: ood for 2 months [1] https://aur.archlinux.org/account/micwoj92/ [2] https://aur.archlinux.org/pkgbase/ninja-fuchsia-git/

1 1

[PRQ#78627] Orphan Request for git-gl
by notify＠aur.archlinux.org 13 Jan '26

13 Jan '26

micwoj92 [1] filed an orphan request for git-gl [2]: ood for 2 months [1] https://aur.archlinux.org/account/micwoj92/ [2] https://aur.archlinux.org/pkgbase/git-gl/

1 1

[PRQ#78619] Orphan Request for microsoft-edge-stable-bin
by notify＠aur.archlinux.org 12 Jan '26

12 Jan '26

ptr1337 [1] filed an orphan request for microsoft-edge-stable-bin [2]: Has been outdated for two weeks, which is quite critical a browser [1] https://aur.archlinux.org/account/ptr1337/ [2] https://aur.archlinux.org/pkgbase/microsoft-edge-stable-bin/

1 1

[PRQ#78600] Orphan Request for faugus-launcher-git
by notify＠aur.archlinux.org 12 Jan '26

12 Jan '26

Muflone [1] filed an orphan request for faugus-launcher-git [2]: the current maintainer asked to delete the package, replacing the deletion request with an orphan request https://lists.archlinux.org/archives/list/aur- requests(a)lists.archlinux.org/thread/LPAJY6XWX5TCBFOBX52LKOEDGKUHRD72/ [1] https://aur.archlinux.org/account/Muflone/ [2] https://aur.archlinux.org/pkgbase/faugus-launcher-git/

1 1

[PRQ#78641] Orphan Request for microsoft-edge-stable-bin
by notify＠aur.archlinux.org 11 Jan '26

11 Jan '26

EarthlingV [1] filed an orphan request for microsoft-edge-stable-bin [2]: maintainer mia [1] https://aur.archlinux.org/account/EarthlingV/ [2] https://aur.archlinux.org/pkgbase/microsoft-edge-stable-bin/

2 2

[PRQ#78589] Orphan Request for knime-desktop
by notify＠aur.archlinux.org 11 Jan '26

11 Jan '26

Dominiquini [1] filed an orphan request for knime-desktop [2]: Package hasn't been updated in a while! [1] https://aur.archlinux.org/account/Dominiquini/ [2] https://aur.archlinux.org/pkgbase/knime-desktop/

1 1

[PRQ#78649] Orphan Request for portablemc
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

theorozier [1] filed an orphan request for portablemc [2]: Hi Maksymilian, I tried to contact you via email, we really need to maintain this repository to support the latest version 5.0.0. If you want to co-own this package, I would be interested. Please check the repository. This is not really an orphan request, but I just want you to read my latest email and keep contact :) Best regards, Théo Rozier [1] https://aur.archlinux.org/account/theorozier/ [2] https://aur.archlinux.org/pkgbase/portablemc/

1 1

[PRQ#78661] Deletion Request for rime-custom-pinyin-dictionary
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

wuhgit [1] filed a deletion request for rime-custom-pinyin-dictionary [2]: The original creator has abandoned updating. [1] https://aur.archlinux.org/account/wuhgit/ [2] https://aur.archlinux.org/pkgbase/rime-custom-pinyin-dictionary/

1 1

[PRQ#78659] Deletion Request for vitamin-browser
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

terpinedream [1] filed a deletion request for vitamin-browser [2]: CRITICAL ISSUES 1. Electron Sandbox Disabled (Critical) The application conditionally launches Electron with --no-sandbox on Linux when unprivileged user namespaces are unavailable. Impact: - Removes Electron’s primary security boundary - Renderer compromise results in full system compromise - Breaks Electron’s security model Fix: - Never disable sandboxing - Handle restricted environments without removing security boundaries 2. Full IPC Exposure to Web Content (Critical) The preload script exposes unrestricted ipcRenderer to window.chrome, allowing any website to call any IPC handler. Impact: - Arbitrary IPC invocation from web content - Access to file operations, navigation, cookies, and data deletion - Enables RCE via bookmarklet and executeJavaScript handlers - Complete browser takeover from a malicious site Fix: - Remove direct IPC exposure - Whitelist allowed IPC channels - Enforce origin and sender validation 3. JavaScript Code Injection via executeJavaScript (Critical) User-controlled values are interpolated into executeJavaScript calls using template literals. Impact: - Direct code injection into page context - Cookie and session theft - Arbitrary script execution Fix: - Never concatenate user input into JavaScript - Use structured messaging (webContents.send) - Serialize data safely (e.g., JSON) HIGH SEVERITY ISSUES Remote Code Execution via Bookmarklets Bookmarklets execute arbitrary JavaScript in any page context without isolation or validation. Fix: - Remove or strictly sandbox bookmarklet execution Widespread XSS (innerHTML misuse) Multiple UI components insert unsanitized data via innerHTML. Fix: - Use textContent instead of innerHTML - Apply proper HTML sanitization (e.g., DOMPurify) No Input Validation on IPC Handlers IPC handlers accept untrusted input without schema validation or bounds checking. Fix: - Enforce strict schemas (Zod, Joi) - Validate all IPC inputs Insecure URL Handling URL validation relies on string matching rather than proper URL parsing. Fix: - Parse URLs using new URL() - Validate scheme and hostname explicitly Directory Traversal in File Operations File paths are not constrained to safe directories. Fix: - Resolve paths and enforce base directory boundaries Plaintext Storage of Sensitive Data Session, history, and bookmark data are stored unencrypted. Fix: - Encrypt sensitive data or minimize stored data - Use OS-backed secure storage when possible Missing Content Security Policy No CSP is set, allowing inline scripts, eval, and easy XSS exploitation. Fix: - Implement a strict CSP - Disallow inline scripts and eval package is not production ready and proves a massive security issue. [1] https://aur.archlinux.org/account/terpinedream/ [2] https://aur.archlinux.org/pkgbase/vitamin-browser/

2 2

[PRQ#78656] Deletion Request for archinstall-latest
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

yochananmarqos [1] filed a deletion request for archinstall-latest [2]: Duplicate of archinstall in extra. [1] https://aur.archlinux.org/account/yochananmarqos/ [2] https://aur.archlinux.org/pkgbase/archinstall-latest/

1 1