Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0437
published 6 months, 3 weeks ago
Permalink CVE-2026-26973
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse doesn't scope reviewable notes to user-visible reviewables

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-c587-qx78-vhmx
NIXPKGS-2026-0436
published 6 months, 3 weeks ago
Permalink CVE-2026-27021
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse: Poll voters endpoint lacked post visibility checks

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-f5m5-9hpw-7c2g
NIXPKGS-2026-0435
published 6 months, 3 weeks ago
Permalink CVE-2026-26207
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

DIscourse's discourse-policy plugin lacks post access check

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-jr4h-w6p5-w55r
NIXPKGS-2026-0434
published 6 months, 3 weeks ago
Permalink CVE-2026-27154
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse has XSS when editing a malicious post

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-xv43-5gcp-wgw8
NIXPKGS-2026-0433
published 6 months, 3 weeks ago
Permalink CVE-2026-26979
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse: TL4 users are able to change status of restricted topics

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-9c7p-fqc5-c24f
NIXPKGS-2026-0432
published 6 months, 3 weeks ago
Permalink CVE-2026-28218
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5
NIXPKGS-2026-0431
published 6 months, 3 weeks ago
Permalink CVE-2026-27162
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

DIscourse doesn't prevent whispers to leak in excerpts

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-gffm-43j4-372w
NIXPKGS-2026-0430
published 6 months, 3 weeks ago
Permalink CVE-2026-26265
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse has IDOR vulnerability in the directory items endpoint

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw
NIXPKGS-2026-0429
published 6 months, 3 weeks ago
Permalink CVE-2026-27152
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

DIscourse has DM communication-preference bypass when adding members

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-f8ff-pxg3-7967
NIXPKGS-2026-0428
published 6 months, 3 weeks ago
Permalink CVE-2026-27149
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse has SQL injection in PM tag filtering

discourse
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0
  • ==>= 2026.1.0-latest, < 2026.1.1 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38w