Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0501
published 6 months, 2 weeks ago
Permalink CVE-2026-3338
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

PKCS7_verify Signature Validation Bypass in AWS-LC

AWS-LC
  • <1.69.0 
Upstream advisory: https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wj
NIXPKGS-2026-0508
published 6 months, 2 weeks ago
Permalink CVE-2026-27167
0.0 NONE
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    8 packages
    • python312Packages.gradio-pdf
    • python313Packages.gradio-pdf
    • python314Packages.gradio-pdf
    • python312Packages.gradio-client
    • python313Packages.gradio-client
    • python314Packages.gradio-client
    • pkgsRocm.python3Packages.gradio-pdf
    • pkgsRocm.python3Packages.gradio-client
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

gradio
  • ==>= 4.16.0, < 6.6.0 
Upstream advisory: https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m
NIXPKGS-2026-0496
published 6 months, 2 weeks ago
Permalink CVE-2026-1628
4.6 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    5 packages
    • mattermost
    • mattermostLatest
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    6 months, 2 weeks ago
  • @LeSuisse deleted
    2 maintainers
    • @liff
    • @jokogr
    6 months, 2 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Mattermost
  • =<5.13.3
  • ==5.13.4.0
NIXPKGS-2026-0504
published 6 months, 2 weeks ago
Permalink CVE-2026-27824
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored package calibre-web 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre
  • ==< 9.4.0 
Upstream advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw
NIXPKGS-2026-0502
published 6 months, 2 weeks ago
Permalink CVE-2026-28415
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    8 packages
    • pkgsRocm.python3Packages.gradio-pdf
    • pkgsRocm.python3Packages.gradio-client
    • python314Packages.gradio-client
    • python313Packages.gradio-client
    • python312Packages.gradio-client
    • python314Packages.gradio-pdf
    • python313Packages.gradio-pdf
    • python312Packages.gradio-pdf
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Gradio has Open Redirect in OAuth Flow

gradio
  • ==< 6.6.0 
Upstream advisory: https://github.com/gradio-app/gradio/security/advisories/GHSA-pfjf-5gxr-995x
NIXPKGS-2026-0494
published 6 months, 2 weeks ago
Permalink CVE-2026-27596
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    10 packages
    • gexiv2
    • libsForQt5.libkexiv2
    • kdePackages.libkexiv2
    • python312Packages.exiv2
    • python313Packages.exiv2
    • python314Packages.exiv2
    • plasma5Packages.libkexiv2
    • python312Packages.py3exiv2
    • python313Packages.py3exiv2
    • python314Packages.py3exiv2
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow

exiv2
  • ==< 0.28.8 
Upstream advisory: https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7
Upstream patch: https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4
NIXPKGS-2026-0500
published 6 months, 2 weeks ago
Permalink CVE-2026-25477
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    10 packages
    • python312Packages.affine
    • python313Packages.affine
    • python314Packages.affine
    • python312Packages.affinegap
    • python313Packages.affinegap
    • python314Packages.affinegap
    • python312Packages.affine-gaps
    • python313Packages.affine-gaps
    • haskellPackages.affinely-extended
    • haskellPackages.simple-affine-space
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

AFFiNE: Open Redirect via Regex Bypass in redirect-proxy

AFFiNE
  • ==< 0.26.0 
Upstream advisory: https://github.com/toeverything/AFFiNE/security/advisories/GHSA-wx9m-v7wq-g289
NIXPKGS-2026-0506
published 6 months, 2 weeks ago
Permalink CVE-2026-3336
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

AWS-LC
  • <1.69.0 
Upstream advisory: https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp
NIXPKGS-2026-0498
published 6 months, 2 weeks ago
Permalink CVE-2026-23865
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    8 packages
    • haskellPackages.freetype2
    • sbclPackages.cl-freetype2
    • haskellPackages.gi-freetype2
    • python312Packages.freetype-py
    • python313Packages.freetype-py
    • python314Packages.freetype-py
    • chickenPackages_5.chickenEggs.freetype
    • tests.pkg-config.defaultPkgConfigPackages.freetype2
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

An integer overflow in the tt_var_load_item_variation_store function of the Freetype …

FreeType
  • =<2.14.1
  • =<2.13.3 
Upstream patch: https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c
Advisory: https://www.facebook.com/security/advisories/cve-2026-23865
NIXPKGS-2026-0499
published 6 months, 2 weeks ago
Permalink CVE-2026-21853
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    10 packages
    • python312Packages.affine
    • python313Packages.affine
    • python314Packages.affine
    • python312Packages.affinegap
    • python313Packages.affinegap
    • python314Packages.affinegap
    • python312Packages.affine-gaps
    • python313Packages.affine-gaps
    • haskellPackages.affinely-extended
    • haskellPackages.simple-affine-space
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

AFFiNE: One-click Remote Code Execution through Custom URL Handling

AFFiNE
  • ==< 0.25.4 
Upstream advisory: https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965