Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2282
published 2 hours ago
datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
Permalink CVE-2026-63720
7.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 hours ago by @LeSuisse Activity log
  • Created suggestion 11 hours ago
  • @LeSuisse accepted 2 hours ago
  • @LeSuisse published on GitHub 2 hours ago

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator
  • <0.70.0
NIXPKGS-2026-2281
published 2 hours ago
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
Permalink CVE-2026-66012
10.0 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): High (H)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 11 hours ago
  • @LeSuisse accepted 2 hours ago
  • @LeSuisse published on GitHub 2 hours ago

SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

siyuan
  • ==3.7.2
  • <3.7.2
NIXPKGS-2026-2280
published 1 day, 21 hours ago
Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
Permalink CVE-2026-16743
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users

accountsservice
Fixed in 26.26.9

https://gitlab.freedesktop.org/accountsservice/accountsservice/-/work_items/138#note_3536647
NIXPKGS-2026-2279
published 1 day, 21 hours ago
Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
Permalink CVE-2026-66338
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored package libsoup_2_4 1 day, 21 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

libsoup
libsoup3
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/533
NIXPKGS-2026-2278
published 1 day, 21 hours ago
Datasets Path Traversal via Unsanitized file_name Metadata
Permalink CVE-2026-66007
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse ignored
    10 packages
    • python313Packages.datasets_3
    • python314Packages.datasets_3
    • python313Packages.geodatasets
    • python314Packages.geodatasets
    • python313Packages.vega-datasets
    • python314Packages.vega-datasets
    • python313Packages.tensorflow-datasets
    • python313Packages.home-assistant-datasets
    • python314Packages.home-assistant-datasets
    • pkgsRocm.python3Packages.tensorflow-datasets
    1 day, 21 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Datasets Path Traversal via Unsanitized file_name Metadata

datasets
  • ==f989ef9b4cc6c0039a7a82458eebca49e2b58b4b
  • =<5.0.0
NIXPKGS-2026-2277
published 1 day, 21 hours ago
Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path
Permalink CVE-2026-17039
3.1 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 10 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

pki-core
dogtag-pki
redhat-pki
Fixed in 11.10.0.
NIXPKGS-2026-2276
published 1 day, 21 hours ago
Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
Permalink CVE-2026-66337
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored package libsoup_2_4 1 day, 21 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

libsoup
libsoup3
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/532
NIXPKGS-2026-2275
published 1 day, 21 hours ago
Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
Permalink CVE-2026-16730
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

rhcos
dbus-broker
NIXPKGS-2026-2274
published 1 day, 21 hours ago
Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
Permalink CVE-2026-66339
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored package libsoup_2_4 1 day, 21 hours ago
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

libsoup
libsoup3
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/534
NIXPKGS-2026-2273
published 1 day, 21 hours ago
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
Permalink CVE-2026-66006
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 day, 21 hours ago by @LeSuisse Activity log
  • Created suggestion 2 days, 11 hours ago
  • @LeSuisse ignored maintainer @philocalyst 1 day, 21 hours ago maintainer.ignore
  • @LeSuisse accepted 1 day, 21 hours ago
  • @LeSuisse published on GitHub 1 day, 21 hours ago

lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS
  • =<1.83.0
  • ==71a45eeb1639d146d34b8effd7e86d077160ed7c