Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0370
published 6 months, 4 weeks ago
Permalink CVE-2026-27015
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS)

FreeRDP
  • ==< 3.23.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/65d59d3b3c2f630f2ea862687ecf5f95f8115244
NIXPKGS-2026-0396
published 6 months, 4 weeks ago
Permalink CVE-2026-25138
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has Username Enumeration via Login Error Message

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9
NIXPKGS-2026-0395
published 6 months, 4 weeks ago
Permalink CVE-2026-27577
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-task-runner-launcher
    • tests.fetchpatch2.relative
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n: Expression Sandbox Escape Leads to RCE

n8n
  • ==< 1.123.22
  • ==>= 2.0.0, < 2.9.3
  • ==>= 2.10.0, < 2.10.1 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr
NIXPKGS-2026-0407
published 6 months, 4 weeks ago
Permalink CVE-2026-27948
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Copyparty vulnerable to eflected cross-site scripting via setck parameter

copyparty
  • ==< 1.20.9 
Upstream advisory: https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h
Upstream patch: https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc
NIXPKGS-2026-0394
published 6 months, 4 weeks ago
Permalink CVE-2026-27497
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-task-runner-launcher
    • tests.fetchpatch2.relative
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n has Potential Remote Code Execution via Merge Node

n8n
  • ==>= 2.0.0, < 2.9.3
  • ==< 1.123.22
  • ==>= 2.10.0, < 2.10.1 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr
NIXPKGS-2026-0393
published 6 months, 4 weeks ago
Permalink CVE-2026-27494
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-task-runner-launcher
    • tests.fetchpatch2.relative
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n has Arbitrary File Read via Python Code Node Sandbox Escape

n8n
  • ==>= 2.0.0, < 2.9.3
  • ==< 1.123.22
  • ==>= 2.10.0, < 2.10.1 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-mmgg-m5j7-f83h
NIXPKGS-2026-0392
published 6 months, 4 weeks ago
Permalink CVE-2026-27578
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-task-runner-launcher
    • tests.fetchpatch2.relative
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n Vulnerable to Stored XSS via Various Nodes

n8n
  • ==>= 2.0.0, < 2.9.3
  • ==< 1.123.22
  • ==>= 2.10.0, < 2.10.1 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92
NIXPKGS-2026-0391
published 6 months, 4 weeks ago
Permalink CVE-2026-27498
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • tests.fetchpatch2.relative
    • n8n-task-runner-launcher
    • n8n-nodes-carbonejs
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n has Arbitrary Command Execution via File Write and Git Operations

n8n
  • ==< 1.123.8
  • ==>= 2.0.0, < 2.2.0 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq
NIXPKGS-2026-0390
published 6 months, 4 weeks ago
Permalink CVE-2026-27493
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • tests.fetchpatch2.relative
    • n8n-task-runner-launcher
    • n8n-nodes-carbonejs
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

n8n has Unauthenticated Expression Evaluation via Form Node

n8n
  • ==>= 2.0.0, < 2.9.3
  • ==< 1.123.22
  • ==>= 2.10.0, < 2.10.1 
Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7
NIXPKGS-2026-0389
published 6 months, 4 weeks ago
Permalink CVE-2026-27626
9.9 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

OliveTin
  • ==<= 3000.10.0 
Upstream advisory: https://github.com/OliveTin/OliveTin/security/advisories/GHSA-49gm-hh7w-wfvf