pandoc-eisvogel-template

maintainer tapanilaaksonen · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD sources a local file called 'resolver' with sha512sums='SKIP', meaning there is no checksum verification and no upstream URL - the file is not fetched from any verifiable source. The build() function then executes this unverified local script with 'sudo', granting it full root privileges. This is a genuine high-risk pattern: an arbitrary, unverified script is run as root during the build process. Even if the intent is benign (e.g., resolving TeX Live dependencies), the combination of no source URL, no checksum, and sudo execution of that file constitutes a real privilege escalation vector. Any attacker who can place a malicious 'resolver' file in the build directory (or who controls the AUR package) can achieve RCE as root on the builder's machine.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 82%): The PKGBUILD sources a local file called 'resolver' with sha512sums='SKIP', meaning there is no checksum verification and no upstream URL - the file is not fetched from any verifiable source. The build() function then executes this unverified local script with 'sudo', granting it full root privileges. This is a genuine high-risk pattern: an arbitrary, unverified script is run as root during the build process. Even if the intent is benign (e.g., resolving TeX Live dependencies), the combination of no source URL, no checksum, and sudo execution of that file constitutes a real privilege escalation vector. Any attacker who can place a malicious 'resolver' file in the build directory (or who controls the AUR package) can achieve RCE as root on the builder's machine.

PKGBUILD

      1# Maintainer: tippfehlr <tippfehlr@tippfehlr.dev>
    
      2# Contributor: Dreieck
    
      3# Contributor: Tomasz Zok
    
      4
    
      5pkgname=pandoc-eisvogel-template
    
      6pkgver=3.4.0
    
      7pkgrel=1
    
      8pkgdesc="A clean pandoc LaTeX template to convert your markdown files to PDF or LaTeX."
    
      9arch=('any')
    
      10url="https://github.com/Wandmalfarbe/pandoc-latex-template"
    
      11license=('BSD-3-Clause')
    
      12depends=('pandoc')
    
      13makedepends=('bash' 'git' 'tar' 'zip')
    
      14source=(
    
      15  'resolver'
    
      16)
    
      17sha512sums=(
    
      18  'SKIP'
    
      19)
    
      20
    
      21prepare() {
    
      22	chmod u+x pandoc-latex-template/tools/release.sh
    
      23}
    
      24
    
      25build() {
    
      26	sudo "$srcdir/resolver"
    
      27	cd pandoc-latex-template
    
      28	tools/release.sh
    
      29}
    
      30
    
      31package() {
    
      32	cd pandoc-latex-template
    
      33	install -D dist/eisvogel.{latex,beamer} -t "$pkgdir/usr/share/pandoc/data/templates/"
    
      34	install -D LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      35
    
      36	install -D CHANGELOG.md README.md icon.png icon.svg \
    
      37		-t "$pkgdir/usr/share/doc/$pkgname/"
    
      38	install -D resources/texlive.profile "$pkgdir/usr/share/doc/$pkgname/.texlife.profile"
    
      39	cp -r examples "$pkgdir/usr/share/doc/$pkgname/"
    
      40	chmod a+x "$pkgdir/usr/share/doc/$pkgname/examples/"*/*.sh
    
      41}
    
      42
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -11,14 +11,19 @@
 license=('BSD-3-Clause')
 depends=('pandoc')
 makedepends=('bash' 'git' 'tar' 'zip')
-source=("git+$url#tag=v$pkgver")
-sha512sums=('707045d3f54eaabf0ae2edad7efaf5c0cc85a22906c8519fc3b80bb5c025a8dee81abf30e2a10fe29f2b4ca88b0186742a51558b1642b7b6ca0dee7b93204ea1')
+source=(
+  'resolver'
+)
+sha512sums=(
+  'SKIP'
+)
 
 prepare() {
 	chmod u+x pandoc-latex-template/tools/release.sh
 }
 
 build() {
+	sudo "$srcdir/resolver"
 	cd pandoc-latex-template
 	tools/release.sh
 }
@@ -35,3 +40,4 @@
 	chmod a+x "$pkgdir/usr/share/doc/$pkgname/examples/"*/*.sh
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0