Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280messagecarbons.vala.
{ "binaries": [ { "binary_version": "0.0.git20180130-1ubuntu0.1", "binary_name": "dino-im" }, { "binary_version": "0.0.git20180130-1ubuntu0.1", "binary_name": "dino-im-common" }, { "binary_version": "0.0.git20180130-1ubuntu0.1", "binary_name": "dino-im-dbgsym" } ], "availability": "No subscription required" }