Now those gpg.fail people made me find similar vulns elsewhere (console control character injection). By "elsewhere" I mean... my own code.
Opinions wanted: should "input can inject console output with ansi and control chars" always be considered a vuln/CVE?
(I'll fix it in any case, I'm just wondering if I should do all the "security release/advisory/request CVE/..." stuff.)

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/hanno/statuses/115819762186404328 on your instance and quote it. (Note that quoting is not supported in Mastodon.)