Consider enrolling Cinnamon, Nemo, cinnamon-screensaver, and Xreader in Anthropic's OSS Scanner

[Tedpac]

Anthropic recently launched OSS Scanner, a free, opt-in service that periodically scans open-source projects with its strongest models and emails each finding to the project, with a reproducer and, when available, a candidate patch. Each repository is enrolled separately, and I'd like to propose four of Mint's: Cinnamon, Nemo, cinnamon-screensaver, and Xreader. I'm offering to do the enrollment work myself.

Why these four

Cinnamon runs in every session of Mint's main edition, and several of its parts matter for security:

• It ships its own polkit authentication agent, the dialog that asks for the user's password before privileged actions.
• Its notification daemon accepts content from any application over D-Bus.
• It downloads and unpacks spices from cinnamon-spices.linuxmint.com.
• It has had a high-severity vulnerability before: CVE-2018-13054, where an unprivileged user could overwrite arbitrary files through a settings tool running as root.

Nemo also runs in every Cinnamon session, since it draws the desktop, and it's the default file manager. Files from USB drives and downloads usually pass through it, along with their names, thumbnails, and .desktop launchers.

cinnamon-screensaver is what keeps the session locked while the user is away, so a bug in how it handles input or authentication can expose everything in it.

Xreader is Mint's default document viewer, so it regularly opens files from untrusted sources. It has had two code execution vulnerabilities of its own, CVE-2023-44451 (EPUB) and CVE-2023-44452 (CBT), and this year it shared a one-click code execution flaw with Atril (CVE-2026-46529).

What I'd need from you

I'd be happy to handle the enrollment PRs to anthropics/oss-scanner, the build setup, and a first draft of each threat model, all without changes to your repos. However, enrollment has to be authorized by a maintainer, so I'd need your go-ahead here (for any or all of the four), the contact address that should receive the reports, and your review of the threat model drafts.

Keep in mind that reports are model-generated and sent without human review, so they'd need triage on your end. Enrollment can be paused or withdrawn at any time.