Nixpkgs security tracker

NIXPKGS-2026-0742

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33173
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Storage has possible content type bypass via metadata in direct uploads
          
      https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg

NIXPKGS-2026-0744

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33170
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                rubyPackages.yard-activesupport-concern
rubyPackages_3_3.yard-activesupport-concern
rubyPackages_3_4.yard-activesupport-concern
rubyPackages_4_0.yard-activesupport-concern

          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
          
      https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activesupport

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v

NIXPKGS-2026-0746

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33176
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                rubyPackages.yard-activesupport-concern
rubyPackages_3_3.yard-activesupport-concern
rubyPackages_3_4.yard-activesupport-concern
rubyPackages_4_0.yard-activesupport-concern

          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Support has a possible DoS vulnerability in its number helpers
          
      https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activesupport

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9

NIXPKGS-2026-0740

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-1940
          
        5.1 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              ignored
            
                8 packages
                gst_all_1.gstreamermm
gst_all_1.gst-vaapi
ocamlPackages_latest.gstreamer
ocamlPackages.gstreamer
libsForQt5.phonon-backend-gstreamer
obs-studio-plugins.obs-gstreamer
plasma5Packages.phonon-backend-gstreamer
tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"

          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Gstreamer: incomplete fix of cve-2026-1940
          
      https://access.redhat.com/security/cve/CVE-2026-1940
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2436932
    
    issue-trackingx_refsource_REDHAT
  
      https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854
    
      https://gstreamer.freedesktop.org/security/sa-2026-0001.html
    
      https://security-tracker.debian.org/tracker/CVE-2026-1940
    
    gstreamer

    gstreamer1

    mingw-gstreamer1

          Advisory: https://gstreamer.freedesktop.org/security/sa-2026-0001.html

NIXPKGS-2026-0741

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33195
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Storage has possible Path Traversal in DiskService
          
      https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87

NIXPKGS-2026-0743

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33168
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails has a possible XSS vulnerability in its Action View tag helpers
          
      https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    actionview

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq

NIXPKGS-2026-0745

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33174
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
          
      https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg

NIXPKGS-2026-0738

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33169
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                rubyPackages.yard-activesupport-concern
rubyPackages_3_3.yard-activesupport-concern
rubyPackages_3_4.yard-activesupport-concern
rubyPackages_4_0.yard-activesupport-concern

          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
          
      https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activesupport

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38

NIXPKGS-2026-0739

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-33202
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            Rails Active Storage has possible glob injection in its DiskService
          
      https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.1.0.beta1, < 8.1.2.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
          Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m

NIXPKGS-2026-0695

GitHub issue published 3 months ago

          Permalink
          
            CVE-2026-32815
          
              updated
            
          3 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months ago
          
          @LeSuisse
          
              accepted
            
          3 months ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months ago
          
            SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure
          
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6
    
    x_refsource_CONFIRM
  
      https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3
    
    x_refsource_MISC
  
      https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
    
    x_refsource_MISC
  
    siyuan

            ==< 3.6.1
          
          Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6
Upstream patch: https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3

Published issues

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails Active Support has a possible DoS vulnerability in its number helpers

Gstreamer: incomplete fix of cve-2026-1940

Rails Active Storage has possible Path Traversal in DiskService

Rails has a possible XSS vulnerability in its Action View tag helpers

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Rails Active Storage has possible glob injection in its DiskService

SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure