Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0685
published 5 months, 4 weeks ago
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse accepted
  • @LeSuisse published on GitHub

Halloy has insecure file permissions on credential files


halloy
  • ==<= 2026.4
Upstream advisory: https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g
Upstream patch: https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb
NIXPKGS-2026-0680
published 5 months, 4 weeks ago
updated 5 months, 4 weeks ago by @mweinelt Activity log
  • Created suggestion
  • @mweinelt accepted
  • @mweinelt ignored
    6 packages
    • discourseAllPlugins
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
  • @mweinelt published on GitHub

Discourse has inferable private group membership or existence via exclude_groups parameter


discourse
  • === 2026.3.0-latest
  • ==>= 2026.1.0-latest, < 2026.1.2
  • ==>= 2026.2.0-latest, < 2026.2.1
https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2
NIXPKGS-2026-0679
published 5 months, 4 weeks ago
Permalink CVE-2026-29794
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 4 weeks ago by @mweinelt Activity log
  • Created suggestion
  • @mweinelt accepted
  • @mweinelt ignored package vikunja-desktop
  • @mweinelt published on GitHub

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers


vikunja
  • ==>= 0.8, < 2.2.0
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx
NIXPKGS-2026-0677
published 5 months, 4 weeks ago
updated 5 months, 4 weeks ago by @mweinelt Activity log
  • Created suggestion
  • @mweinelt accepted
  • @mweinelt ignored
    6 packages
    • discourseAllPlugins
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
  • @mweinelt published on GitHub

Discourse hasUnauthorized Exposure of Private User Action Types


discourse
  • ==>= 2026.2.0-latest, < 2026.2.1
  • === 2026.3.0-latest.1
  • ==>= 2026.1.0-latest, < 2026.1.2
https://github.com/discourse/discourse/security/advisories/GHSA-ww5f-24g5-c33g
NIXPKGS-2026-0681
published 5 months, 4 weeks ago
updated 5 months, 4 weeks ago by @mweinelt Activity log
  • Created suggestion
  • @mweinelt accepted
  • @mweinelt ignored
    7 packages
    • claude-code-acp
    • claude-code-bin
    • claude-code-router
    • gnomeExtensions.claude-code-usage
    • gnomeExtensions.claude-code-switcher
    • vscode-extensions.anthropic.claude-code
    • gnomeExtensions.claude-code-usage-indicator
  • @mweinelt published on GitHub

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File


claude-code
  • ==< 2.1.53
Vulnerability remains unfixed on NixOS 25.11
NIXPKGS-2026-0678
published 5 months, 4 weeks ago
Permalink CVE-2026-33422
3.5 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 4 weeks ago by @mweinelt Activity log
  • Created suggestion
  • @mweinelt accepted
  • @mweinelt ignored
    6 packages
    • discourseAllPlugins
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
  • @mweinelt published on GitHub

Discourse exposes ip_address of flagged user


discourse
  • ==>= 2026.2.0-latest, < 2026.2.1
  • === 2026.3.0-latest
  • ==>= 2026.1.0-latest, < 2026.1.2
https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84
NIXPKGS-2026-0676
published 6 months ago
Permalink CVE-2026-3979
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    7 packages
    • python312Packages.quickjs
    • python313Packages.quickjs
    • python314Packages.quickjs
    • haskellPackages.mquickjs-hs
    • python312Packages.llm-tools-quickjs
    • python313Packages.llm-tools-quickjs
    • python314Packages.llm-tools-quickjs
  • @LeSuisse accepted
  • @LeSuisse published on GitHub

quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free


quickjs
  • ==0.12.1
  • ==0.12.0
Upstream issue: https://github.com/quickjs-ng/quickjs/issues/1368
Upstream patch: https://github.com/quickjs-ng/quickjs/commit/daab4ad4bae4ef071ed0294618d6244e92def4cd
NIXPKGS-2026-0675
published 6 months ago
Permalink CVE-2026-32230
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    7 packages
    • python312Packages.uptime-kuma-api
    • python313Packages.uptime-kuma-api
    • python314Packages.uptime-kuma-api
    • gnomeExtensions.uptime-kuma-indicator
    • python312Packages.uptime-kuma-monitor
    • python313Packages.uptime-kuma-monitor
    • python314Packages.uptime-kuma-monitor
  • @LeSuisse deleted maintainer @JulienMalka maintainer.delete
  • @LeSuisse accepted
  • @LeSuisse published on GitHub

Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page


uptime-kuma
  • ==>= 2.0.0, < 2.2.0
Upstream advisory: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h
Upstream patch: https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febae
NIXPKGS-2026-0671
published 6 months ago
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored package clasp-common-lisp
  • @LeSuisse accepted
  • @LeSuisse published on GitHub

Arbitrary File Write via Path Traversal in Google clasp leading to RCE


Clasp
  • ==< 3.2.0
Upstream patch: https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3
NIXPKGS-2026-0665
published 6 months ago
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    8 packages
    • gst_all_1.gst-vaapi
    • gst_all_1.gstreamermm
    • ocamlPackages.gstreamer
    • ocamlPackages_latest.gstreamer
    • obs-studio-plugins.obs-gstreamer
    • libsForQt5.phonon-backend-gstreamer
    • plasma5Packages.phonon-backend-gstreamer
    • tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
  • @LeSuisse accepted
  • @LeSuisse published on GitHub

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability


GStreamer
  • ==1c6e163aa33962f5ee4a87d29319ccdd5cb67612
OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2