Source: keepassxc Version: 2.7.10+dfsg1-1 Severity: important Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer and Security Team, I am reporting the public upstream advisory GHSA-2vm2-vmc3-vccr for assessment in Debian: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-2vm2-vmc3-vccr A malicious website can cause credentials saved through the browser extension to contain references to other database entries. When those credentials are subsequently filled, information from the referenced entries can be disclosed to the website. The advisory describes user interaction as required and rates the issue Moderate. The advisory lists affected versions as < 2.7.12 and the patched version as 2.8.0. The upstream release announcement says the security issues affect the 2.7.x series. Debian's 2.7.10 falls within the stated affected range. The release notes associate this fix with upstream PRs #13580, #13670 and #13688. Browser integration is present in the keepassxc-full variant. The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026: https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/ I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have not independently reproduced this issue or verified whether Debian-specific patches address it. On 10 October 2026, I could not find a corresponding entry on the package's Security Tracker page or a matching report in the current source-package bug list. Could you assess whether Debian is affected and consider backporting the applicable fix to trixie? Please adjust the severity as appropriate. Thank you, Jonatan Nyberg
