Re: Fixing security vulnerabilities before new releases

> @@ -299,7 +299,8 @@ vc-find-backend-function
>    "Return BACKEND-specific implementation of FUN.
>  If there is no such implementation, return the default implementation;
>  if that doesn't exist either, return nil."
> -  (let ((f (vc-make-backend-sym backend fun)))
> +  (let* ((read-symbol-shorthands nil)   ; Mitigate CVE-2026-XXXXX
> +         (f (vc-make-backend-sym backend fun)))
>      (if (fboundp f) f
>        ;; Load vc-BACKEND.el if needed.
>        (require (intern (concat "vc-" (downcase (symbol-name backend)))))

I'd move the let-binding to `vc-make-backend-sym` (i.e. to right around
the relevant `intern` call).

I'm sure there are other holes related to the over-enthusiastic use of
`read-symbol-shorthands` in `intern`, so we could introduce an
`intern--without-shorthands` and replace the few `intern` calls we see
as risky.


=== Stefan