Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0418
published 6 months, 4 weeks ago
Permalink CVE-2026-27945
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package zitadel-tools 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ZITADEL has potential SSRF via Actions

zitadel
  • ==>= 2.59.0, < 4.11.1 
Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v
NIXPKGS-2026-0417
published 6 months, 4 weeks ago
Permalink CVE-2026-27946
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package zitadel-tools 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API

zitadel
  • ==>= 4.0.0, < 4.11.0
  • ==< 3.4.7 
Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54
NIXPKGS-2026-0416
published 6 months, 4 weeks ago
Permalink CVE-2026-27840
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package zitadel-tools 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ZITADEL's truncated opaque tokens are still valid

zitadel
  • ==>= 2.31.0, <= 2.71.19
  • ==>= 4.0.0, < 4.11.0
  • ==>= 3.0.0, < 3.4.7 
Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-6mq3-xmgp-pjm5
NIXPKGS-2026-0415
published 6 months, 4 weeks ago
Permalink CVE-2026-27457
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    6 packages
    • python312Packages.weblate-schemas
    • python313Packages.weblate-schemas
    • python314Packages.weblate-schemas
    • python312Packages.weblate-language-data
    • python313Packages.weblate-language-data
    • python314Packages.weblate-language-data
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

weblate
  • ==< 5.16.1 
Upstream advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv
Upstream patches:
* https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9
* https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f
NIXPKGS-2026-0414
published 6 months, 4 weeks ago
Permalink CVE-2026-27965
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vitess users with backup storage access can gain unauthorized access to production deployment environments

vitess
  • ==>= 23.0.0, < 23.0.3
  • ==< 22.0.4 
Upstream advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x
Upstream patch: https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c
NIXPKGS-2026-0413
published 6 months, 4 weeks ago
Permalink CVE-2026-27884
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

NetExec
  • ==< 1.5.1 
Upstream advisory: https://github.com/Pennyw0rth/NetExec/security/advisories/GHSA-fccr-6qm2-7h27
Upstream patch: https://github.com/Pennyw0rth/NetExec/commit/7d027f2774d0520b322d60f9c99b9ab3edb4035e
NIXPKGS-2026-0412
published 6 months, 4 weeks ago
Permalink CVE-2026-27887
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    25 packages
    • spin
    • aspino
    • upspin
    • openspin
    • tailspin
    • python314Packages.click-spinner
    • python313Packages.click-spinner
    • python312Packages.click-spinner
    • python314Packages.aiosendspin
    • python313Packages.aiosendspin
    • python314Packages.spinners
    • python313Packages.spinners
    • python312Packages.spinners
    • haskellPackages.spine
    • sbclPackages.spinneret
    • haskellPackages.Spintax
    • python312Packages.yaspin
    • python313Packages.yaspin
    • python314Packages.yaspin
    • python312Packages.outspin
    • python313Packages.outspin
    • python314Packages.outspin
    • python312Packages.pyspinel
    • python313Packages.pyspinel
    • python314Packages.pyspinel
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Spin has memory leaks in various WIT interfaces

spin
  • ==< 3.6.1
SpinKube
  • ==< 0.6.2
containerd-shim-spin
  • ==< 0.22.1 
Upstream advisory: https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx
NIXPKGS-2026-0411
published 6 months, 4 weeks ago
Permalink CVE-2026-27900
5.0 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure

terraform-provider-linode
  • ==< 3.9.0 
Upstream advisory: https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64
Upstream patch: https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0
NIXPKGS-2026-0410
published 6 months, 4 weeks ago
Permalink CVE-2026-28295
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses

gvfs
Upstream issue: https://gitlab.gnome.org/GNOME/gvfs/-/issues/832
Upstream patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/20db8173252ea88a4af05dc9a24aad6f29b807ad
NIXPKGS-2026-0409
published 6 months, 4 weeks ago
Permalink CVE-2026-27888
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    7 packages
    • capypdf
    • python314Packages.pypdfium2
    • python313Packages.pypdfium2
    • python312Packages.pypdfium2
    • python313Packages.pypdf3
    • python314Packages.pypdf3
    • python312Packages.pypdf3
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

pypdf
  • ==< 6.7.3 
Upstream advisory: https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj
Upstream patch: https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c