January 2026 - Aur-requests - lists.archlinux.org

[PRQ#78671] Deletion Request for idos-timetable-data-chaps-trains-pid-2025-latest
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

dreieck [1] filed a deletion request for idos-timetable-data-chaps- trains-pid-2025-latest [2]: Obsolete; timetable period is over. Source file will be deleted from upstream soon. [1] https://aur.archlinux.org/account/dreieck/ [2] https://aur.archlinux.org/pkgbase/idos-timetable-data-chaps-trains-pid-2025…

1 1

[PRQ#78670] Deletion Request for raspberrypi-devicetree-git
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

labuwx [1] filed a deletion request for raspberrypi-devicetree-git [2]: This package was used for AArch64 Arch Linux ARM on a Raspberry Pi. No longer needed. [1] https://aur.archlinux.org/account/labuwx/ [2] https://aur.archlinux.org/pkgbase/raspberrypi-devicetree-git/

1 1

[PRQ#78668] Deletion Request for gnome-twitch-player-backend-gstreamer-clutter-git
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

tee [1] filed a deletion request for gnome-twitch-player-backend- gstreamer-clutter-git [2]: software abandoned by upstream, and irreparably broken package, many issues https://github.com/vinszent/gnome-twitch/issues [1] https://aur.archlinux.org/account/tee/ [2] https://aur.archlinux.org/pkgbase/gnome-twitch-player-backend-gstreamer-clu…

1 1

[PRQ#78665] Deletion Request for freetube-git-d3sox
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

D3SOX [1] filed a deletion request for freetube-git-d3sox [2]: Please delete. Upstream told me to rebrand my fork to not use "FreeTube" in its name so the new package is opentubex-git [1] https://aur.archlinux.org/account/D3SOX/ [2] https://aur.archlinux.org/pkgbase/freetube-git-d3sox/

1 1

[PRQ#78661] Deletion Request for rime-custom-pinyin-dictionary
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

wuhgit [1] filed a deletion request for rime-custom-pinyin-dictionary [2]: The original creator has abandoned updating. [1] https://aur.archlinux.org/account/wuhgit/ [2] https://aur.archlinux.org/pkgbase/rime-custom-pinyin-dictionary/

1 1

[PRQ#78659] Deletion Request for vitamin-browser
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

terpinedream [1] filed a deletion request for vitamin-browser [2]: CRITICAL ISSUES 1. Electron Sandbox Disabled (Critical) The application conditionally launches Electron with --no-sandbox on Linux when unprivileged user namespaces are unavailable. Impact: - Removes Electron’s primary security boundary - Renderer compromise results in full system compromise - Breaks Electron’s security model Fix: - Never disable sandboxing - Handle restricted environments without removing security boundaries 2. Full IPC Exposure to Web Content (Critical) The preload script exposes unrestricted ipcRenderer to window.chrome, allowing any website to call any IPC handler. Impact: - Arbitrary IPC invocation from web content - Access to file operations, navigation, cookies, and data deletion - Enables RCE via bookmarklet and executeJavaScript handlers - Complete browser takeover from a malicious site Fix: - Remove direct IPC exposure - Whitelist allowed IPC channels - Enforce origin and sender validation 3. JavaScript Code Injection via executeJavaScript (Critical) User-controlled values are interpolated into executeJavaScript calls using template literals. Impact: - Direct code injection into page context - Cookie and session theft - Arbitrary script execution Fix: - Never concatenate user input into JavaScript - Use structured messaging (webContents.send) - Serialize data safely (e.g., JSON) HIGH SEVERITY ISSUES Remote Code Execution via Bookmarklets Bookmarklets execute arbitrary JavaScript in any page context without isolation or validation. Fix: - Remove or strictly sandbox bookmarklet execution Widespread XSS (innerHTML misuse) Multiple UI components insert unsanitized data via innerHTML. Fix: - Use textContent instead of innerHTML - Apply proper HTML sanitization (e.g., DOMPurify) No Input Validation on IPC Handlers IPC handlers accept untrusted input without schema validation or bounds checking. Fix: - Enforce strict schemas (Zod, Joi) - Validate all IPC inputs Insecure URL Handling URL validation relies on string matching rather than proper URL parsing. Fix: - Parse URLs using new URL() - Validate scheme and hostname explicitly Directory Traversal in File Operations File paths are not constrained to safe directories. Fix: - Resolve paths and enforce base directory boundaries Plaintext Storage of Sensitive Data Session, history, and bookmark data are stored unencrypted. Fix: - Encrypt sensitive data or minimize stored data - Use OS-backed secure storage when possible Missing Content Security Policy No CSP is set, allowing inline scripts, eval, and easy XSS exploitation. Fix: - Implement a strict CSP - Disallow inline scripts and eval package is not production ready and proves a massive security issue. [1] https://aur.archlinux.org/account/terpinedream/ [2] https://aur.archlinux.org/pkgbase/vitamin-browser/

2 2

[PRQ#78656] Deletion Request for archinstall-latest
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

yochananmarqos [1] filed a deletion request for archinstall-latest [2]: Duplicate of archinstall in extra. [1] https://aur.archlinux.org/account/yochananmarqos/ [2] https://aur.archlinux.org/pkgbase/archinstall-latest/

1 1

[PRQ#78652] Deletion Request for reboot-to-windows
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

Wartybix [1] filed a deletion request for reboot-to-windows [2]: I don't maintain the upstream repo for this package anymore. [1] https://aur.archlinux.org/account/Wartybix/ [2] https://aur.archlinux.org/pkgbase/reboot-to-windows/

1 1

[PRQ#78651] Merge Request for fey-git
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

sykik [1] filed a request to merge fey-git [2] into fey [3]: Renaming package to fey as per project rebranding. [1] https://aur.archlinux.org/account/sykik/ [2] https://aur.archlinux.org/pkgbase/fey-git/ [3] https://aur.archlinux.org/pkgbase/fey/

1 1

[PRQ#78650] Merge Request for lwm-wm
by notify＠aur.archlinux.org 10 Jan '26

10 Jan '26

TypCoder1 [1] filed a request to merge lwm-wm [2] into lwm-legacy [3]: Package renamed from lwm-wm to lwm-legacy [1] https://aur.archlinux.org/account/TypCoder1/ [2] https://aur.archlinux.org/pkgbase/lwm-wm/ [3] https://aur.archlinux.org/pkgbase/lwm-legacy/

1 1