Backport six-CVE security review (release 20.3.4+security.1)#1

Merged

icanhasmath merged 6 commits into

20.3.4-security

Jun 2, 2026

Commits on Jun 2, 2026

Backport CVE-2021-3572: stop splitting git refs on unicode separators

icanhasmath
and
claude
committed
Backport CVE-2023-5752: prevent option injection via Mercurial revision

icanhasmath
and
claude
committed
Backport CVE-2026-1703: enforce component boundary in is_within_directory

icanhasmath
and
claude
committed
Backport CVE-2025-8869: validate tar symlink targets on the extraction fallback

icanhasmath
and
claude
committed
Backport CVE-2026-3219: disambiguate tar/zip archive detection in unpack_file

icanhasmath
and
claude
committed
Release 20.3.4+security.1: backport six-CVE security review

icanhasmath
and
claude
committed