Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0800
published 5 months, 3 weeks ago
Permalink CVE-2026-29055
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored package gnome-recipes 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

recipes
  • ==< 2.6.0 
Upstream advisory: https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9g2j-xccg-9mhq
NIXPKGS-2026-0802
published 5 months, 3 weeks ago
Permalink CVE-2026-2272
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    28 packages
    • zigimports
    • gimpPlugins.bimp
    • gimpPlugins.gimp
    • gimpPlugins.gmic
    • gimp-with-plugins
    • gimp2Plugins.bimp
    • gimp2Plugins.gimp
    • gimp2Plugins.gmic
    • gimp3Plugins.gimp
    • gimp3Plugins.gmic
    • gimp2-with-plugins
    • gimp3-with-plugins
    • gimpPlugins.fourier
    • gimp2Plugins.fourier
    • gimpPlugins.farbfeld
    • gimp2Plugins.farbfeld
    • gimpPlugins.lightning
    • gimpPlugins.lqrPlugin
    • gimpPlugins.texturize
    • gimp2Plugins.lightning
    • gimp2Plugins.lqrPlugin
    • gimp2Plugins.texturize
    • gimp3Plugins.lightning
    • gimpPlugins.gimplensfun
    • gimp2Plugins.gimplensfun
    • gimpPlugins.resynthesizer
    • gimpPlugins.waveletSharpen
    • gimp2Plugins.waveletSharpen
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Gimp: gimp: memory corruption due to integer overflow in ico file handling

gimp
gimp:2.8/gimp
Upstream advisory: https://gitlab.gnome.org/GNOME/gimp/-/issues/15617
NIXPKGS-2026-0805
published 5 months, 3 weeks ago
Permalink CVE-2026-28788
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

open-webui
  • ==< 0.8.6 
Upstream advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-jjp7-g2jw-wh3j
NIXPKGS-2026-0808
published 5 months, 3 weeks ago
Permalink CVE-2026-33481
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Syft improper temporary file cleanup

syft
  • ==< 1.42.3 
Upstream advisory: https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc
NIXPKGS-2026-0774
published 5 months, 3 weeks ago
Permalink CVE-2026-33314
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @mweinelt ignored
    5 packages
    • python312Packages.pyloadapi
    • python313Packages.pyloadapi
    • python314Packages.pyloadapi
    • home-assistant-component-tests.pyload
    • tests.home-assistant-component-tests.pyload
    5 months, 3 weeks ago
  • @mweinelt accepted 5 months, 3 weeks ago
  • @mweinelt published on GitHub 5 months, 3 weeks ago

pyload-ng: Improper Authentication and Origin Validation Error

pyload
  • ==< 0.5.0b3.dev97 
Upstream advisory: https://github.com/pyload/pyload/security/advisories/GHSA-q485-cg9q-xq2r
NIXPKGS-2026-0764
published 5 months, 3 weeks ago
Permalink CVE-2026-33219
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS is vulnerable to pre-auth DoS through WebSockets client service

nats-server
  • ==>= 2.12.0-RC.1, < 2.12.6
  • ==< 2.11.15 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j
NIXPKGS-2026-0754
published 5 months, 3 weeks ago
Permalink CVE-2026-33722
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

n8n Has External Secrets Authorization Bypass in Credential Saving

n8n
  • ==>= 2.0.0-rc.0, < 2.6.4
  • ==< 1.123.23 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-fxcw-h3qj-8m8p
NIXPKGS-2026-0757
published 5 months, 3 weeks ago
Permalink CVE-2026-33749
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

n8n
  • === 2.14.0
  • ==>= 2.0.0-rc.0, < 2.13.3
  • ==< 1.123.27 
https://github.com/n8n-io/n8n/security/advisories/GHSA-qfc3-hm4j-7q77
NIXPKGS-2026-0758
published 5 months, 3 weeks ago
Permalink CVE-2026-33215
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS is vulnerable to MQTT hijacking via Client ID

nats-server
  • ==>= 2.12.0-RC.1, < 2.12.6
  • ==< 2.11.15 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879
NIXPKGS-2026-0759
published 5 months, 3 weeks ago
Permalink CVE-2026-33218
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS has pre-auth server panic via leafnode handling

nats-server
  • ==< < 2.11.15
  • ==>= 2.12.0-RC.1, < 2.12.6 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339