Kejcao

In the `node:child process` implementation on Windows, the `escapeShellArg()` helper function fails to properly quote arguments containing `cmd.exe` metacharacters (such as `&`, `|`, `<`, `>`, `^`, `!`, `(`, and `)`) and does not neutralize the `%` character, which `cmd.exe` expands even within double-quoted strings. This occurs when callers use the `spawn`, `spawnSync`, or `exec` functions with the `shell: true` option. An attacker who can control any part of an argument passed to these calls can inject and execute arbitrary commands within the context of the Deno process.

Insufficient escaping of HTML-significant characters, specifically angle brackets, occurs in text nodes during the conversion of a parsed document to Markdown using the `to markdown()` function. While some Markdown metacharacters are escaped, characters like < and > are preserved. This allows untrusted input—such as entity-decoded text or content from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext>—to be emitted as raw HTML in the Markdown output. This behavior can lead to a sanitizer bypass and potential cross-site scripting when the output is rendered.

pypdf is a free and open-source pure-python PDF library. A crafted PDF file can cause an infinite loop when read in non-strict mode. This issue requires reading a file in non-strict mode. Applying the changes from the patch manually is a potential workaround if upgrading is not immediately possible.