Hello,

mailman3-web's postinst contains:

    if [ -n "$su_name" ] && [ -n "$su_mail" ] && [ -n "$su_password" ]; then
        $su_cmd "$django_admin shell $django_admin_args --command \
            \"from django.contrib.auth.models import User; \
              User.objects.filter(username='$su_name').delete(); \
              User.objects.create_superuser('$su_name', \
              '$su_mail', '$su_password')\"" www-data
    fi

This is not robust for su_password (or su_name or su_mail) containing "
or '. When in the debconf dialog such a password is provided, in the
simplest case the script terminates with

	sh: 1: Syntax error: Unterminated quoted string

But worse things can happen, see https://xkcd.com/327/. :-)

Best regards
Uwe