MaxxedSUSE
de09bd730e
- Mitigate CVE-2026-56876: Added `extract-zip-cve-2026-56876.patch` to prevent arbitrary file writes via path traversal using malicious symlinks in `extract-zip`. - Mitigate CVE-2026-54673: Added inline sed replacement to fix credential leak in `electron-updater`'s HTTP redirect handler. - Mitigate CVE-2026-54672: Added inline sed replacement to fix `LD_LIBRARY_PATH` hijack in `app-builder-lib` AppRun.sh templates. Note: Although the native openSUSE RPM package is not practically affected by the electron-updater/AppImage vulnerabilities (since we build with `--dir` and disable auto-updates in favor of `zypper`), the embedded code within node_modules is sanitized during the `%build` phase to ensure defense-in-depth and satisfy automated vulnerability scanners.