Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2382
published 2 minutes ago
cpio: security issues (CVE-2026-66484, CVE-2026-66485, CVE-2026-66486)
Permalink CVE-2026-66486
4.6 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 minutes ago by @LeSuisse Activity log
  • Created suggestion 5 hours ago
  • @LeSuisse ignored
    4 packages
    • _3cpio
    • mkinitcpio-nfs-utils
    • perlPackages.ArchiveCpio
    • perl5Packages.ArchiveCpio
    6 minutes ago
  • @LeSuisse ignored reference https://g… 4 minutes ago
  • @LeSuisse accepted 4 minutes ago
  • @LeSuisse published on GitHub 2 minutes ago

Improper Output Encoding in GNU cpio

cpio
  • =<2.15 
Patch: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30
Permalink CVE-2026-66485
4.6 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 minutes ago by @LeSuisse Activity log
  • Created suggestion 5 hours ago
  • @LeSuisse ignored
    4 packages
    • _3cpio
    • mkinitcpio-nfs-utils
    • perlPackages.ArchiveCpio
    • perl5Packages.ArchiveCpio
    4 minutes ago
  • @LeSuisse ignored reference https://g… 4 minutes ago
  • @LeSuisse accepted 3 minutes ago
  • @LeSuisse published on GitHub 2 minutes ago

Uncontrolled Memory Allocation in GNU cpio

cpio
  • =<2.15 
Patch: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9
Permalink CVE-2026-66484
4.6 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 2 minutes ago by @LeSuisse Activity log
  • Created suggestion 5 hours ago
  • @LeSuisse ignored
    4 packages
    • _3cpio
    • mkinitcpio-nfs-utils
    • perlPackages.ArchiveCpio
    • perl5Packages.ArchiveCpio
    3 minutes ago
  • @LeSuisse ignored reference https://g… 3 minutes ago
  • @LeSuisse accepted 3 minutes ago
  • @LeSuisse published on GitHub 2 minutes ago

Path Traversal in GNU cpio

cpio
  • =<2.15 
Patch: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
NIXPKGS-2026-2381
published 19 hours ago
Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Permalink CVE-2026-15816
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored reference https://b… 19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

rhcos
dracut
Not yet fixed upstream (2026-08-10)
NIXPKGS-2026-2380
published 19 hours ago
Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering
Permalink CVE-2026-11425
2.0 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Active (A)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Active (A)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering

Domoticz
  • <2026.3
NIXPKGS-2026-2379
published 19 hours ago
Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Permalink CVE-2026-19017
6.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored
    8 packages
    • consul-alerts
    • consul-template
    • python313Packages.consul
    • python314Packages.consul
    • prometheus-consul-exporter
    • terraform-providers.consul
    • terraform-providers.hashicorp_consul
    • envconsul
    19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul
  • <2.0.3
Consul Enterprise
  • <2.0.3
NIXPKGS-2026-2378
published 19 hours ago
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags
Permalink CVE-2026-19082
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored
    12 packages
    • perlPackages.ImagerQRCode
    • perl5Packages.ImagerQRCode
    • python313Packages.aliyun-python-sdk-imagerecog
    • python314Packages.aliyun-python-sdk-imagerecog
    • imager
    • usbimager
    • vcdimager
    • rpi-imager
    • gImageReader
    • gimagereader
    • gImageReader-qt
    • gimagereader-qt
    19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager
  • <1.034
NIXPKGS-2026-2377
published 19 hours ago
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Permalink CVE-2026-48120
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored
    13 packages
    • kakoune-cr
    • kakoune-lsp
    • kakoune-unwrapped
    • kakounePlugins.kakoune-lsp
    • kakounePlugins.kakoune-buffers
    • kakounePlugins.kakoune-rainbow
    • kakounePlugins.kakoune-registers
    • kakounePlugins.kakoune-catppuccin
    • kakounePlugins.kakoune-easymotion
    • kakounePlugins.kakoune-state-save
    • kakounePlugins.kakoune-buffer-switcher
    • kakounePlugins.kakoune-extra-filetypes
    • kakounePlugins.kakoune-vertical-selection
    19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Kakoune has a Critical RCE via Autorestore Backup Filename Injection

kakoune
  • ==< 2026.05.21 
Backport needed
NIXPKGS-2026-2376
published 19 hours ago
Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
Permalink CVE-2026-19079
4.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

rhcos
policycoreutils
policycoreutils-main
  • *
NIXPKGS-2026-2375
published 19 hours ago
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
Permalink CVE-2026-61477
2.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored
    14 packages
    • libvirt-dbus
    • libvirt-glib
    • python313Packages.libvirt
    • rubyPackages.ruby-libvirt
    • ocamlPackages.ocaml_libvirt
    • prometheus-libvirt-exporter
    • terraform-providers.libvirt
    • rubyPackages_3_3.ruby-libvirt
    • rubyPackages_3_4.ruby-libvirt
    • rubyPackages_4_0.ruby-libvirt
    • python313Packages.libvirt-python
    • python314Packages.libvirt-python
    • ocamlPackages_latest.ocaml_libvirt
    • terraform-providers.dmacvicar_libvirt
    19 hours ago
  • @LeSuisse restored package python313Packages.libvirt-python 19 hours ago
  • @LeSuisse ignored
    2 packages
    • python313Packages.libvirt-python
    • python314Packages.libvirt
    19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

libvirt
virt:rhel/libvirt
Fixed in 12.6.0
NIXPKGS-2026-2374
published 19 hours ago
lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML
Permalink CVE-2026-48026
8.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

lakeFS
  • ==< 1.81.1
lakeFS-enterprise
  • ==< 1.84.0 
Backport needed
NIXPKGS-2026-2373
published 19 hours ago
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Permalink CVE-2026-54338
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 19 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 5 hours ago
  • @LeSuisse ignored
    6 packages
    • python313Packages.jupyterhub-systemdspawner
    • python314Packages.jupyterhub-systemdspawner
    • python313Packages.jupyterhub-tmpauthenticator
    • python314Packages.jupyterhub-tmpauthenticator
    • python313Packages.jupyterhub-ldapauthenticator
    • python314Packages.jupyterhub-ldapauthenticator
    19 hours ago
  • @LeSuisse accepted 19 hours ago
  • @LeSuisse published on GitHub 19 hours ago

JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

jupyterhub
  • ==< 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0. 
Backport needed.