CVE-2025-59518:
(postponed; to be fixed through a stable update)
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/l/lemonldap-ng.png){kind=link}