Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0760
published 5 months, 3 weeks ago
Permalink CVE-2026-33246
6.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

nats-server
  • ==>= 2.12.0-RC.1, < 2.12.6
  • ==< 2.11.15 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-55h8-8g96-x4hj
NIXPKGS-2026-0761
published 5 months, 3 weeks ago
Permalink CVE-2026-27889
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

nats-server
  • ==>= 2.2.0, < 2.11.14
  • ==>= 2.12.0, < 2.12.5 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6
NIXPKGS-2026-0762
published 5 months, 3 weeks ago
Permalink CVE-2026-33249
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS: Message tracing can be redirected to arbitrary subject

nats-server
  • ==>= 2.11.0, < 2.11.15
  • ==>= 2.12.0-preview.1, < 2.12.6 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j
NIXPKGS-2026-0763
published 5 months, 3 weeks ago
Permalink CVE-2026-33223
6.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

nats-server
  • ==>= 2.12.0-RC.1, < 2.12.6
  • ==< 2.11.15 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
NIXPKGS-2026-0771
published 5 months, 3 weeks ago
Permalink CVE-2026-33217
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NATS allows MQTT clients to bypass ACL checks

nats-server
  • ==< 2.11.15
  • ==>= 2.12.0-RC.1, < 2.12.6 
Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5
NIXPKGS-2026-0775
published 5 months, 3 weeks ago
Permalink CVE-2026-33509
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 3 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @mweinelt ignored
    5 packages
    • python312Packages.pyloadapi
    • python313Packages.pyloadapi
    • python314Packages.pyloadapi
    • home-assistant-component-tests.pyload
    • tests.home-assistant-component-tests.pyload
    5 months, 3 weeks ago
  • @mweinelt accepted 5 months, 3 weeks ago
  • @mweinelt published on GitHub 5 months, 3 weeks ago

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

pyload
  • ==>= 0.4.0, < 0.5.0b3.dev97 
Upstream advisory: https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx
NIXPKGS-2026-0755
published 5 months, 3 weeks ago
Permalink CVE-2026-30976
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    2 packages
    • home-assistant-component-tests.sonarr
    • tests.home-assistant-component-tests.sonarr
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Sonarr Path Traversal vulnerability

Sonarr
  • ==>= 4.0, < 4.0.17.2950 
Upstream advisory: https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f
NIXPKGS-2026-0753
published 5 months, 3 weeks ago
Permalink CVE-2026-33713
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression

n8n
  • === 2.14.0
  • ==>= 2.0.0-rc.0, < 2.13.3
  • ==< 1.123.26 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-98c2-4cr3-4jc3
NIXPKGS-2026-0752
published 5 months, 3 weeks ago
Permalink CVE-2026-33724
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

n8n
  • ==< 2.5.0 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6
NIXPKGS-2026-0751
published 5 months, 3 weeks ago
Permalink CVE-2026-33663
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

n8n
  • === 2.14.0
  • ==>= 2.0.0-rc.0, < 2.13.3
  • ==< 1.123.27 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-m63j-689w-3j35