Nixpkgs security tracker

Untriaged

Permalink CVE-2026-64628

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 2 months ago Activity log

Created suggestion 2 months ago

Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

References

GitHub Security Advisory (GHSA-q5fw-vpqc-fgph) vendor-advisory
VulnCheck Advisory: Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers third-party-advisory

Affected products

grav

=<6.2.1

Matching in nixpkgs

pkgs.grav

Fast, simple, and flexible, file-based web platform

nixos-unstable -
- nixos-unstable-small 1.7.53.3
nixos-26.05 -
- nixos-26.05-small 1.7.53.3

pkgs.grav_2

Fast, simple, and flexible, file-based web platform

nixos-unstable -
- nixos-unstable-small 2.1.8

pkgs.gravit

Beautiful OpenGL-based gravity simulator

nixos-unstable -
- nixos-unstable-small 0.5.1
nixos-26.05 -
- nixos-26.05-small 0.5.1

pkgs.antigravity

Agentic development platform, evolving the IDE into the agent-first era

nixos-unstable -
- nixos-unstable-small 2.5.5
nixos-26.05 -
- nixos-26.05-small 1.23.2

pkgs.antigravity-acp

Google's AI coding agent. Official ACP server powered by Antigravity

nixos-unstable -
- nixos-unstable-small 1.1.1

pkgs.antigravity-cli

Google's Go-based terminal user interface (TUI) agent client

nixos-unstable -
- nixos-unstable-small 1.2.3

pkgs.antigravity-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

nixos-unstable -
- nixos-unstable-small 2.5.5
nixos-26.05 -
- nixos-26.05-small 1.23.2

pkgs.antigravity-hub

Desktop environment for managing multiple autonomous agents across independent projects

nixos-unstable -
- nixos-unstable-small 2.12.2

pkgs.antigravity-ide

Agentic development platform, evolving the IDE into the agent-first era

nixos-unstable -
- nixos-unstable-small 2.5.5

pkgs.antigravity-ide-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications