Nixpkgs security tracker
8.2 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.
References
-
https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv x_refsource_CONFIRM
-
https://github.com/withastro/astro/pull/17109 x_refsource_MISC
-
https://github.com/withastro/astro/releases/tag/astro@6.4.8 x_refsource_MISC
Affected products
- ==>= 6.4.7, < 6.4.8
Matching in nixpkgs
pkgs.astroid
GTK frontend to the notmuch mail system
pkgs.astrolog
Freeware astrology program
pkgs.gnuastro
GNU astronomy utilities and library
pkgs.astroterm
Celestial viewer for the terminal, written in C
pkgs.astromenace
Hardcore 3D space shooter with spaceship upgrade possibilities
pkgs.sddm-astronaut
Modern looking qt6 sddm theme
-
nixos-unstable 0-unstable-2026-05-12
- nixpkgs-unstable 0-unstable-2026-05-12
- nixos-unstable-small 0-unstable-2026-05-12
-
nixos-26.05 0-unstable-2026-05-12
- nixos-26.05-small 0-unstable-2026-05-12
- nixpkgs-26.05-darwin 0-unstable-2026-05-12
pkgs.astrolabe-generator
Java-based tool for generating EPS files for constructing astrolabes and related tools
pkgs.typstPackages.astro
Draw beautiful astronomical diagrams
pkgs.astro-language-server
Astro language server
pkgs.python313Packages.astroid
Abstract syntax tree for Python with inference support
pkgs.python313Packages.astropy
Astronomy/Astrophysics library for Python
pkgs.python314Packages.astroid
Abstract syntax tree for Python with inference support
pkgs.python314Packages.astropy
Astronomy/Astrophysics library for Python
pkgs.typstPackages.astro_0_1_0
Draw beautiful astronomical diagrams
pkgs.indi-3rdparty.indi-astroasis
Third party drivers for the INDI astronomical software suite
-
nixos-unstable 3rdparty-indi-astroasis-2.2.0
- nixpkgs-unstable 3rdparty-indi-astroasis-2.2.0
- nixos-unstable-small 3rdparty-indi-astroasis-2.2.0
-
nixos-26.05 3rdparty-indi-astroasis-2.2.0
- nixos-26.05-small 3rdparty-indi-astroasis-2.2.0
- nixpkgs-26.05-darwin 3rdparty-indi-astroasis-2.2.0
pkgs.perlPackages.AstroFITSHeader
Object-oriented interface to FITS HDUs
pkgs.python313Packages.astroquery
Functions and classes to access online data resources
pkgs.python314Packages.astroquery
Functions and classes to access online data resources
pkgs.perl5Packages.AstroFITSHeader
Object-oriented interface to FITS HDUs
pkgs.python313Packages.asdf-astropy
Extension library for ASDF to provide support for Astropy
pkgs.python314Packages.asdf-astropy
Extension library for ASDF to provide support for Astropy
pkgs.azure-cli-extensions.astronomer
Microsoft Azure Command-Line Tools Astronomer Extension
pkgs.python313Packages.pytest-astropy
Meta-package containing dependencies for testing
pkgs.python314Packages.pytest-astropy
Meta-package containing dependencies for testing
pkgs.python313Packages.astropy-healpix
BSD-licensed HEALPix for Astropy
pkgs.python313Packages.astropy-helpers
Utilities for building and installing Astropy, Astropy affiliated packages, and their respective documentation
pkgs.python314Packages.astropy-healpix
BSD-licensed HEALPix for Astropy
pkgs.python314Packages.astropy-helpers
Utilities for building and installing Astropy, Astropy affiliated packages, and their respective documentation
pkgs.python313Packages.astropy-iers-data
IERS data maintained by @astrofrog and astropy.utils.iers maintainers
-
nixos-unstable 0.2026.1.19.0.42.31
- nixpkgs-unstable 0.2026.1.19.0.42.31
- nixos-unstable-small 0.2026.1.19.0.42.31
-
nixos-26.05 0.2026.1.19.0.42.31
- nixos-26.05-small 0.2026.1.19.0.42.31
- nixpkgs-26.05-darwin 0.2026.1.19.0.42.31
pkgs.python314Packages.astropy-iers-data
IERS data maintained by @astrofrog and astropy.utils.iers maintainers
-
nixos-unstable 0.2026.1.19.0.42.31
- nixpkgs-unstable 0.2026.1.19.0.42.31
- nixos-unstable-small 0.2026.1.19.0.42.31
-
nixos-26.05 0.2026.1.19.0.42.31
- nixos-26.05-small 0.2026.1.19.0.42.31
- nixpkgs-26.05-darwin 0.2026.1.19.0.42.31
pkgs.tree-sitter-grammars.tree-sitter-astro
Tree-sitter grammar for astro
-
nixos-unstable 0-unstable-2025-04-23
- nixpkgs-unstable 0-unstable-2025-04-23
- nixos-unstable-small 0-unstable-2025-04-23
-
nixos-26.05 0-unstable-2025-04-23
- nixos-26.05-small 0-unstable-2025-04-23
- nixpkgs-26.05-darwin 0-unstable-2025-04-23
pkgs.python313Packages.pytest-astropy-header
Plugin to add diagnostic information to the header of the test output
pkgs.python314Packages.pytest-astropy-header
Plugin to add diagnostic information to the header of the test output
pkgs.vimPlugins.nvim-treesitter-parsers.astro
Tree-sitter grammar for astro
-
nixos-unstable 0.0.0+rev=213f6e6
- nixpkgs-unstable 0.0.0+rev=213f6e6
- nixos-unstable-small 0.0.0+rev=213f6e6
-
nixos-26.05 0.0.0+rev=213f6e6
- nixos-26.05-small 0.0.0+rev=213f6e6
- nixpkgs-26.05-darwin 0.0.0+rev=213f6e6
pkgs.vscode-extensions.astro-build.astro-vscode
Astro language support for VS Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-astro
Python bindings for tree-sitter-astro
-
nixos-unstable 0+unstable20250423
- nixpkgs-unstable 0+unstable20250423
- nixos-unstable-small 0+unstable20250423
-
nixos-26.05 0+unstable20250423
- nixos-26.05-small 0+unstable20250423
- nixpkgs-26.05-darwin 0+unstable20250423
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-astro
Python bindings for tree-sitter-astro
-
nixos-unstable 0+unstable20250423
- nixpkgs-unstable 0+unstable20250423
- nixos-unstable-small 0+unstable20250423
-
nixos-26.05 0+unstable20250423
- nixos-26.05-small 0+unstable20250423
- nixpkgs-26.05-darwin 0+unstable20250423
Package maintainers
-
@MiniHarinn Harinn <prinn.dev@pm.me>
-
@god464 god464
-
@SuprDewd Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>
-
@bdimcheff Brandon Dimcheff <brandon@dimcheff.com>
-
@kmein Kierán Meinhardt <kmein@posteo.de>
-
@fgaz Francesco Gazzetta <fgaz@fgaz.me>
-
@da-luce Dalton Luce <daltonluce42@gmail.com>
-
@katexochen Paul Meyer <katexochen0@gmail.com>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@sheepforce Phillip Seeber <phillip.seeber@googlemail.com>
-
@returntoreality Linus Karl <linus@lotz.li>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@doronbehar Doron Behar <me@doronbehar.com>
-
@KentJames James Kent <jameschristopherkent@gmail.com>
-
@smaret Sébastien Maret <sebastien.maret@icloud.com>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@qweered Aliaksandr Samatyia <grubian2@gmail.com>
-
@DaniD3v DaniD3v <sch220233@spengergasse.at>
-
@uxodb uxodb
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>
-
@cherrypiejam Gongqi Huang
-
@RossSmyth Ross Smyth