Dear Maintainer and Security Team,

I am reporting the public upstream advisory GHSA-2vm2-vmc3-vccr for
assessment in Debian:
https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-2vm2-vmc3-vccr

A malicious website can cause credentials saved through the browser
extension to contain references to other database entries. When those
credentials are subsequently filled, information from the referenced
entries can be disclosed to the website. The advisory describes user
interaction as required and rates the issue Moderate.

The advisory lists affected versions as < 2.7.12 and the patched
version as 2.8.0. The upstream release announcement says the security
issues affect the 2.7.x series. Debian's 2.7.10 falls within the
stated affected range.

The release notes associate this fix with upstream PRs #13580, #13670
and #13688. Browser integration is present in the keepassxc-full
variant.

The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026:
https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/

I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have
not independently reproduced this issue or verified whether
Debian-specific patches address it. On 10 October 2026, I could not
find a corresponding entry on the package's Security Tracker page or a
matching report in the current source-package bug list.

Could you assess whether Debian is affected and consider backporting
the applicable fix to trixie? Please adjust the severity as
appropriate.

Thank you,
Jonatan Nyberg