From 04c2dcfc21709e61d1740ac06cc04f3ea5ff2bde Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 17 Aug 2026 13:47:40 +0200
Subject: [PATCH] zip: fix command injection

There is no CVE assigned yet. See:
https://security-tracker.debian.org/tracker/TEMP-1143866-6DBA82

(cherry picked from commit dd9b9f6c0b6d8f4b0a9de973958689169dd57c70)
---
 pkgs/by-name/zi/zip/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 22b7bab6170a..e67be89c2a9b 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -88,6 +88,14 @@ stdenv.mkDerivation (finalAttrs: {
       patch = "buffer-overflow-cve-2018-13410.patch";
       hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
     })
+    # Command injection in zip -T for specially crafted file
+    # names. See: https://seclists.org/oss-sec/2026/q3/494
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "fix-command-injection.patch";
+      hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI=";
+    })
   ]
   ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];