NIXPKGS-2026-0447

GitHub issue published 6 months, 4 weeks ago

          Permalink
          
            CVE-2026-27794
          
        6.6 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): High (H)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): High (H)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 4 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
                9 packages
                python312Packages.langgraph-checkpoint-sqlite
python313Packages.langgraph-checkpoint-sqlite
python314Packages.langgraph-checkpoint-sqlite
python312Packages.langgraph-checkpoint-mongodb
python313Packages.langgraph-checkpoint-mongodb
python314Packages.langgraph-checkpoint-mongodb
python312Packages.langgraph-checkpoint-postgres
python313Packages.langgraph-checkpoint-postgres
python314Packages.langgraph-checkpoint-postgres

          6 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 4 weeks ago
          
            LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution
          
      https://github.com/langchain-ai/langgraph/security/advisories/GHSA-mhr3-j7m5-c7c9
    
    x_refsource_CONFIRM
  
      https://github.com/langchain-ai/langgraph/pull/6677
    
    x_refsource_MISC
  
      https://github.com/langchain-ai/langgraph/commit/f91d79d0c86932ded6e3b9f195d5a0bbd5aef99c
    
    x_refsource_MISC
  
      https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D4.0.0
    
    x_refsource_MISC
  
    langgraph-checkpoint

            ==< 4.0.0
          
            Upstream advisory: https://github.com/langchain-ai/langgraph/security/advisories/GHSA-mhr3-j7m5-c7c9

NIXPKGS-2026-0446

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2024-56373

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

apache-airflow

<2.11.1

Upstream announcement: https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy

NIXPKGS-2026-0445

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-27477

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
11 packages
- mastodon-bot
- bitlbee-mastodon
- mastodon-archive
- nodePackages.mastodon-bot
- python312Packages.mastodon-py
- python313Packages.mastodon-py
- python314Packages.mastodon-py
- nodePackages_latest.mastodon-bot
- home-assistant-component-tests.mastodon
- tests.home-assistant-component-tests.mastodon
- wordpressPackages.plugins.simple-mastodon-verification
6 months, 4 weeks ago
@LeSuisse deleted
4 maintainers
- @Izorkin
- @ghuntley
- @happy-river
- @erictapen
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Mastodon has SSRF via unvalidated FASP Provider base_url

https://github.com/mastodon/mastodon/security/advisories/GHSA-46w6-g98f-wxqm x_refsource_CONFIRM
https://github.com/mastodon/mastodon/commit/7b85d2182361e68d51d9a02f94fb1070b5f503b1 x_refsource_MISC

mastodon

==>= 4.4.0, < 4.4.14
==>= 4.5.0, < 4.5.7

Upstream advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-46w6-g98f-wxqm

NIXPKGS-2026-0444

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-27468

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
11 packages
- mastodon-bot
- bitlbee-mastodon
- mastodon-archive
- nodePackages.mastodon-bot
- python312Packages.mastodon-py
- python313Packages.mastodon-py
- python314Packages.mastodon-py
- nodePackages_latest.mastodon-bot
- home-assistant-component-tests.mastodon
- tests.home-assistant-component-tests.mastodon
- wordpressPackages.plugins.simple-mastodon-verification
6 months, 4 weeks ago
@LeSuisse deleted
4 maintainers
- @Izorkin
- @ghuntley
- @happy-river
- @erictapen
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Mastodon may allow unconfirmed FASP to make subscriptions

https://github.com/mastodon/mastodon/security/advisories/GHSA-qgmm-vr4c-ggjg x_refsource_CONFIRM
https://github.com/mastodon/mastodon/commit/6ba6285a73c3a8b281123814d45f534e3bcebb96 x_refsource_MISC

mastodon

==>= 4.4.0, < 4.4.14
==>= 4.5.0, < 4.5.7

Upstream advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-qgmm-vr4c-ggjg

NIXPKGS-2026-0443

GitHub issue published 6 months, 4 weeks ago

          Permalink
          
            CVE-2026-26331
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 4 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
                12 packages
                python312Packages.yt-dlp
python313Packages.yt-dlp
python314Packages.yt-dlp
python312Packages.yt-dlp-ejs
python313Packages.yt-dlp-ejs
python314Packages.yt-dlp-ejs
python312Packages.yt-dlp-light
python313Packages.yt-dlp-light
python314Packages.yt-dlp-light
python312Packages.yt-dlp-dearrow
python313Packages.yt-dlp-dearrow
python314Packages.yt-dlp-dearrow

          6 months, 4 weeks ago
          
          @LeSuisse
          
              deleted
            
                2 maintainers
                @SuperSandro2000
@4evy

          6 months, 4 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          6 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 4 weeks ago
          
            yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
          
      https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
    
    x_refsource_CONFIRM
  
      https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a
    
    x_refsource_MISC
  
      https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
    
    x_refsource_MISC
  
    yt-dlp

            ==>= 2023.06.21, < 2026.02.21
          
            Upstream advisory: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm

NIXPKGS-2026-0442

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-28227

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

https://github.com/discourse/discourse/security/advisories/GHSA-m49w-78mh-87jp x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m49w-78mh-87jp

NIXPKGS-2026-0441

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-26078

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint

https://github.com/discourse/discourse/security/advisories/GHSA-frx4-wg35-4r68 x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-frx4-wg35-4r68

NIXPKGS-2026-0440

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-28219

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners

https://github.com/discourse/discourse/security/advisories/GHSA-8v26-9f7h-jc8x x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-8v26-9f7h-jc8x

NIXPKGS-2026-0439

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-27153

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse doesn't prevent moderators from exporting user Chat DMs

https://github.com/discourse/discourse/security/advisories/GHSA-5cp2-jq8m-33mf x_refsource_CONFIRM

discourse

==< 2025.12.2
==>= 2026.1.0-latest, < 2026.1.1
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-5cp2-jq8m-33mf

NIXPKGS-2026-0438

GitHub issue published 6 months, 4 weeks ago

Permalink CVE-2026-26077

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse doesn't ensure webhooks require a token

https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw

Nixpkgs security tracker

Published issues

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

Mastodon has SSRF via unvalidated FASP Provider base_url

Mastodon may allow unconfirmed FASP to make subscriptions

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint

Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners

Discourse doesn't prevent moderators from exporting user Chat DMs

Discourse doesn't ensure webhooks require a token