Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0010
published 7 months ago
Permalink CVE-2025-14946
4.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • ocamlPackages.nbd
    • python312Packages.libnbd
    • python313Packages.libnbd
    6 months, 4 weeks ago
  • @LeSuisse deleted maintainer @akshatagarwl 6 months, 4 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri

libnbd
  • <1.23.9
  • <1.22.5
virt:rhel/libnbd
container-native-virtualization/virt-cdi-cloner
container-native-virtualization/virt-cdi-importer
container-native-virtualization/virt-cdi-operator
container-native-virtualization/virt-cdi-apiserver
container-native-virtualization/virt-cdi-controller
container-native-virtualization/virt-cdi-uploadproxy
container-native-virtualization/virt-cdi-cloner-rhel9
container-native-virtualization/virt-cdi-uploadserver
container-native-virtualization/virt-cdi-importer-rhel9
container-native-virtualization/virt-cdi-operator-rhel9
container-native-virtualization/virt-cdi-apiserver-rhel9
container-native-virtualization/virt-cdi-controller-rhel9
container-native-virtualization/virt-cdi-uploadproxy-rhel9
container-native-virtualization/virt-cdi-uploadserver-rhel9
https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/WTUYQOUVHYQVGER3G2AFWN3IYSIU3KTO/
NIXPKGS-2026-0012
published 7 months ago
Permalink CVE-2025-59030
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

pdns-recursor
  • <5.3.3
  • <5.2.7
  • <5.1.9 
Upstream advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html
NIXPKGS-2026-0011
published 7 months ago
Permalink CVE-2025-67554
5.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability

cookie-notice
  • =<<= 2.5.8
NIXPKGS-2026-0009
published 7 months ago
Permalink CVE-2025-15346
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse deleted
    2 maintainers
    • @fabaff
    • @vifino
    6 months, 4 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

wolfssl
  • =<5.8.2
NIXPKGS-2026-0008
published 7 months ago
Permalink CVE-2025-14881
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package pretix-banktool 7 months ago
  • @LeSuisse deleted maintainer @mweinelt 7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

Insecure direct object reference

pretix
  • <2025.10.0
  • <2025.8.0
  • <2025.11.0
  • <2025.9.0 
https://github.com/NixOS/nixpkgs/pull/472420 (Unstable)
https://github.com/NixOS/nixpkgs/pull/472424 (25.11)
NIXPKGS-2026-0002
published 7 months ago
Permalink CVE-2025-34457
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS

direwolf
  • =<1.8
  • =<1.8.1
  • ==commit 694c954 
Patch: https://github.com/wb2osz/direwolf/commit/694c95485b21c1c22bc4682703771dec4d7a374b
NIXPKGS-2026-0003
published 7 months ago
Permalink CVE-2025-69195
7.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse deleted maintainer @SuperSandro2000 7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls

wget2
  • ==2.2.1
  • =<2.2.0
NIXPKGS-2026-0004
published 7 months ago
Permalink CVE-2025-69194
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse deleted maintainer @SuperSandro2000 7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

Wget2: arbitrary file write via metalink path traversal in gnu wget2

wget2
  • ==2.2.1
  • =<2.2.0
NIXPKGS-2026-0005
published 7 months ago
Permalink CVE-2025-34458
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

wb2osz/direwolf <= 1.8 Reachable Assertion DoS

direwolf
  • =<1.8
  • =<1.8.1
  • ==commit 3658a87 
Patch: https://github.com/wb2osz/direwolf/commit/3658a878920803bbb69a4567579dcc4d6cb80a92
NIXPKGS-2026-0006
published 7 months ago
Permalink CVE-2025-34451
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

rofl0r/proxychains-ng <= 4.17 Stack-based Buffer Overflow

proxychains-ng
  • =<4.17
  • ==commit cc005b7 
Patch: https://github.com/httpsgithu/proxychains-ng/commit/cc005b7132811c9149e77b5e33cff359fc95512e