Kejcao

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.7.10 **Description** In the `node:child process` implementation on Windows, the `escapeShellArg()` helper function fails to properly quote arguments containing `cmd.exe` metacharacters (such as `&`, `|`, `<`, `>`, `^`, `!`, `(`, and `)`) and does not neutralize the `%` character, which `cmd.exe` expands even within double-quoted strings. This occurs when callers use the `spawn`, `spawnSync`, or `exec` functions with the `shell: true` option. An attacker who can control any part of an argument passed to these calls can inject and execute arbitrary commands within the context of the Deno process. **Recommendations** Update Deno to version 2.7.10. As a temporary workaround, avoid using `shell: true` in `node:child process` calls on Windows. As a temporary workaround, build the argument vector directly and invoke the program without a shell. As a temporary workaround, filter or reject any externally-supplied argument values containing `cmd.exe` metacharacters (`&`, `|`, `<`, `>`, `^`, `!`, `(`, `)`, `%`) before passing them to `spawn`, `spawnSync`, or `exec`.

**Name of the Vulnerable Software and Affected Versions** justhtml versions prior to 1.12.0 **Description** Insufficient escaping of HTML-significant characters, specifically angle brackets, occurs in text nodes during the conversion of a parsed document to Markdown using the `to markdown()` function. While some Markdown metacharacters are escaped, characters like < and > are preserved. This allows untrusted input—such as entity-decoded text or content from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext>—to be emitted as raw HTML in the Markdown output. This behavior can lead to a sanitizer bypass and potential cross-site scripting when the output is rendered. **Recommendations** Update to version 1.12.0.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.9.2 **Description** pypdf is a free and open-source pure-python PDF library. A crafted PDF file can cause an infinite loop when read in non-strict mode. This issue requires reading a file in non-strict mode. Applying the changes from the patch manually is a potential workaround if upgrading is not immediately possible. **Recommendations** Upgrade to version 6.9.2 or later. If an immediate upgrade is not possible, apply the changes from PR #3693 manually.