Follow-up on security reports #1842: remediation status and CVE coordination #2996

Hi Chat2DB maintainers,

I'm following up on the Zip Slip and Zip Bomb issues referenced in #1842, which I subsequently submitted through GitHub Private Vulnerability Reporting as requested. The private reports still appear to be awaiting review on my side. I also sent a follow-up email on November 3, 2026, but have not yet received a response, so I am opening this issue to help coordinate the next steps.

I understand that #1842 was closed to move the discussion to the private security channel, rather than because the reports had been rejected. This issue is only a request for a status update; technical details and validation materials can remain in the private reports.

I noticed that #2632 includes relevant archive-handling protections, but the PR remains open and unmerged. When I reviewed the main branch for my November 3 follow-up, the affected logic still appeared to be present. Please let me know if a fix has since been merged through another PR or released elsewhere.

Could you please help clarify the following?

1. Report validation and remediation: Have the two private reports been reviewed, and is there an expected remediation timeline?
2. Assistance with a fix: I would be happy to submit a focused security-fix PR or assist with regression testing. Would you prefer a separate PR or support with the existing one? I can coordinate any security-sensitive changes through the private reports first.
3. CVE coordination: If remediation will take additional time, would it be possible to first confirm the validity of the two reports, accept them through GitHub Private Vulnerability Reporting, and request the appropriate CVE IDs through GitHub's security advisory workflow? This would help us track the issues while the fixes are being prepared.

I'm happy to provide any additional information or harmless validation materials privately and coordinate disclosure with you. This public issue intentionally omits reproduction details and PoC materials. A brief acknowledgement here or an update in the private reports would be appreciated.

Thank you for your time and help.

Jay17