Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2547

NIXPKGS-2026-2547
published 7 hours ago
In the opam package before 2.5.2 for OCaml, the sandbox …
Permalink CVE-2026-57825
5.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 18 hours ago
  • @LeSuisse ignored
    14 packages
    • dopamine
    • opam2json
    • opam-publish
    • opam-installer
    • ocamlPackages.opam-core
    • ocamlPackages.opam-state
    • ocamlPackages.opam-client
    • ocamlPackages.opam-format
    • ocamlPackages.opam-solver
    • ocamlPackages.ez_opam_file
    • ocamlPackages.opam-repository
    • ocamlPackages.opam-file-format
    • ocamlPackages_latest.opam-core
    • ocamlPackages_latest.opam-state
    7 hours ago
  • @LeSuisse ignored reference https://g… 7 hours ago
  • @LeSuisse ignored
    11 packages
    • ocamlPackages.opam-0install-cudf
    • ocamlPackages_latest.opam-client
    • ocamlPackages_latest.opam-format
    • ocamlPackages_latest.opam-solver
    • ocamlPackages_latest.ez_opam_file
    • ocamlPackages_latest.opam-repository
    • ocamlPackages_latest.opam-file-format
    • tree-sitter-grammars.tree-sitter-opam
    • ocamlPackages_latest.opam-0install-cudf
    • python313Packages.tree-sitter-grammars.tree-sitter-opam
    • python314Packages.tree-sitter-grammars.tree-sitter-opam
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago
In the opam package before 2.5.2 for OCaml, the sandbox …

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

Affected products

opam
  • <2.5.2

Matching in nixpkgs

pkgs.opam

Package manager for OCaml

Ignored packages (25)

pkgs.opam2json

Convert opam file syntax to JSON

  • nixos-unstable 0.4
    • nixpkgs-unstable 0.5
    • nixos-unstable-small 0.5
  • nixos-26.05 0.4
    • nixos-26.05-small 0.4
    • nixpkgs-26.05-darwin 0.4

pkgs.ocamlPackages.opam-solver

This library is based on the Cudf and Dose libraries, and handles calls to the external solver from opam

Needs a backport