Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0388
published 7 months ago
Permalink CVE-2026-27616
7.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package vikunja-desktop 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

vikunja
  • ==< 2.0.0 
Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7jp5-298q-jg98
NIXPKGS-2026-0412
published 7 months ago
Permalink CVE-2026-27887
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    25 packages
    • spin
    • aspino
    • upspin
    • openspin
    • tailspin
    • python314Packages.click-spinner
    • python313Packages.click-spinner
    • python312Packages.click-spinner
    • python314Packages.aiosendspin
    • python313Packages.aiosendspin
    • python314Packages.spinners
    • python313Packages.spinners
    • python312Packages.spinners
    • haskellPackages.spine
    • sbclPackages.spinneret
    • haskellPackages.Spintax
    • python312Packages.yaspin
    • python313Packages.yaspin
    • python314Packages.yaspin
    • python312Packages.outspin
    • python313Packages.outspin
    • python314Packages.outspin
    • python312Packages.pyspinel
    • python313Packages.pyspinel
    • python314Packages.pyspinel
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Spin has memory leaks in various WIT interfaces

spin
  • ==< 3.6.1
SpinKube
  • ==< 0.6.2
containerd-shim-spin
  • ==< 0.22.1 
Upstream advisory: https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx
NIXPKGS-2026-0387
published 7 months ago
Permalink CVE-2026-26103
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package deepin.udisks2-qt5 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api

udisks
udisks2
Upstream advisory: https://github.com/storaged-project/udisks/security/advisories/GHSA-c75h-phf8-ccjm
Upstream patch: https://github.com/storaged-project/udisks/commit/dca17c25c12d99a5d4f257b96f9df59c9c02952a
NIXPKGS-2026-0386
published 7 months ago
Permalink CVE-2026-27116
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package vikunja-desktop 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

vikunja
  • ==< 2.0.0 
Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qgr-4h56-8895
NIXPKGS-2026-0385
published 7 months ago
Permalink CVE-2026-27575
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package vikunja-desktop 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

vikunja
  • ==< 2.0.0 
Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8
NIXPKGS-2026-0384
published 7 months ago
Permalink CVE-2026-27819
7.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package vikunja-desktop 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vikunja has Path Traversal in CLI Restore

vikunja
  • ==< 2.0.0 
Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh
NIXPKGS-2026-0383
published 7 months ago
Permalink CVE-2026-26104
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package deepin.udisks2-qt5 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api

udisks
udisks2
Upstream advisory: https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw
Upstream patch: https://github.com/storaged-project/udisks/commit/4353c0610089218ac4813edc05cc1662b7a9d6dd
NIXPKGS-2026-0417
published 7 months ago
Permalink CVE-2026-27946
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package zitadel-tools 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API

zitadel
  • ==>= 4.0.0, < 4.11.0
  • ==< 3.4.7 
Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54
NIXPKGS-2026-0382
published 7 months ago
Permalink CVE-2026-27611
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    4 packages
    • filebrowser
    • python312Packages.filebrowser-safe
    • python313Packages.filebrowser-safe
    • python314Packages.filebrowser-safe
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

filebrowser
  • ==>= 1.2.0-beta, < 1.2.6-beta
  • ==< 1.1.3-stable 
Upstream advisory: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
Upstream patch: https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1
NIXPKGS-2026-0381
published 7 months ago
Permalink CVE-2026-27808
5.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

mailpit
  • ==< 1.29.2 
Upstream advisory: https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3
Upstream patch: https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5