Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0017
published 6 months ago
Permalink CVE-2026-22816
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    6 packages
    • gradle-dependency-tree-diff
    • vscode-extensions.vscjava.vscode-gradle
    • gradle_9-unwrapped
    • gradle_8-unwrapped
    • gradle_7-unwrapped
    • gradle-completion
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Gradle fails to disable repositories which can expose builds to malicious artifacts

gradle
  • ==< 9.3.0 
Upstream advisory: https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82
NIXPKGS-2026-0027
published 6 months ago
Permalink CVE-2026-23535
8.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    3 packages
    • wlcs
    • wlclock
    • imewlconverter
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

wlc Path traversal: Unsanitized API slugs in download command

wlc
  • ==< 1.17.2 
Upstream advisory: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
Upstream patch: https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f
NIXPKGS-2026-0023
published 6 months ago
Permalink CVE-2026-22857
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a heap-use-after-free in irp_thread_func

FreeRDP
  • ==< 3.20.1 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8
NIXPKGS-2026-0024
published 6 months ago
Permalink CVE-2026-22865
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    6 packages
    • gradle-completion
    • gradle_7-unwrapped
    • gradle_8-unwrapped
    • gradle_9-unwrapped
    • gradle-dependency-tree-diff
    • vscode-extensions.vscjava.vscode-gradle
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts

gradle
  • ==< 9.3.0 
Upstream advisory: https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv
NIXPKGS-2026-0022
published 6 months ago
Permalink CVE-2026-22853
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

FreeRDP
  • ==< 3.20.1 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch
NIXPKGS-2026-0021
published 6 months ago
Permalink CVE-2026-23490
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    4 packages
    • python312Packages.pysnmp-pyasn1
    • python313Packages.pysnmp-pyasn1
    • python312Packages.pyasn1-modules
    • python313Packages.pyasn1-modules
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

pyasn1 has a DoS vulnerability in decoder

pyasn1
  • ==< 0.6.2 
Upstream advisory: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
Upstream fix: https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
NIXPKGS-2026-0025
published 6 months ago
Permalink CVE-2026-23645
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

siyuan
  • ==< 3.5.4-dev2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
Upstream patch: https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388
NIXPKGS-2026-0016
published 6 months ago
Permalink CVE-2026-0716
4.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored package tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Libsoup: out-of-bounds read in libsoup websocket frame processing

libsoup
libsoup3
Fix MR: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/494
NIXPKGS-2026-0015
published 6 months ago
Permalink CVE-2026-0989
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    8 packages
    • libxml2Python
    • sbclPackages.cl-libxml2
    • perlPackages.AlienLibxml2
    • python312Packages.libxml2
    • python313Packages.libxml2
    • perl538Packages.AlienLibxml2
    • perl540Packages.AlienLibxml2
    • tests.pkg-config.defaultPkgConfigPackages."libxml-2.0"
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Libxml2: unbounded relaxng include recursion leading to stack overflow

rhcos
libxml2
Fix MR: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374
NIXPKGS-2026-0014
published 6 months ago
Permalink CVE-2026-0992
2.9 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored
    8 packages
    • libxml2Python
    • sbclPackages.cl-libxml2
    • perlPackages.AlienLibxml2
    • python312Packages.libxml2
    • python313Packages.libxml2
    • perl538Packages.AlienLibxml2
    • perl540Packages.AlienLibxml2
    • tests.pkg-config.defaultPkgConfigPackages."libxml-2.0"
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Libxml2: libxml2: denial of service via crafted xml catalogs

rhcos
libxml2
Fix MR: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/368