vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit 8bff99a99dee297bfc354c8a4a59f95db436324d
Merge: 7cbe5f9 8a62787
Author: kokoye2007 <kokoye2007@gmail.com>
Date: Tue Sep 15 04:29:54 2026 +1000
Merge pull request #36 from ph-rast/qr-command-injection
Fix command injection via crafted Wi-Fi QR code
commit 8a6278773f49f1021d13975e5948e9b48322135d
Author: Philippe Rast <ph-rast@users.noreply.github.com>
Date: Tue Jul 28 19:10:59 2026 +0200
Update wifi-qr
legacy mode escapes corrected to original. Got doubled during copy-paste
commit 360462bd6a0718761daa4b8a603b72ce1321d3c8
Author: Philippe Rast <ph-rast@users.noreply.github.com>
Date: Tue Jul 28 19:06:05 2026 +0200
Update wifi-qr
Restore legacy escaped-semicolon handling
commit 4b65805b899dde2d744e6e880b58bb29eae92849
Author: Philippe Rast <ph-rast@users.noreply.github.com>
Date: Tue Jul 28 18:59:48 2026 +0200
Fix command injection in Wi-Fi QR parsing
Scanned QR content was parsed into an associative array via eval. The
value side was quoted with @Q, but the key (${element%%:*}) was left
unquoted, so a command substitution placed in the key position of a
crafted QR code was executed by eval as the invoking user.
Replace urimap_str with urimap_parse, which populates the array by
nameref and assigns keys/values directly, removing the eval entirely.
For a declare -A array the subscript is a plain string, so hostile keys
are inert. Normal WiFi:S:...;T:...;P:...; codes still parse unchanged.
Reachable via all scan modes (-s, -q, -f, -p). CWE-78.
commit 7cbe5f9b71026865181c69dfa6c482590d3912b7
Author: kokoye2007 <kokoye2007@gmail.com>
Date: Sat Feb 1 01:19:42 2025 +1100
dput softfile_debian
Signed-off-by: kokoye2007 <kokoye2007@gmail.com>
![[bug history graph]](https://qa.debian.org/data/bts/graphs/w/wifi-qr.png){kind=link}