Nixpkgs security tracker

Dismissed

Permalink CVE-2026-23523

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
7 packages
- dive
- git-dive
- libdivecomputer
- haskellPackages.diversity
- haskellPackages.data-diverse
- typstPackages.diverential_0_2_0
- gnomeExtensions.the-indie-beat-fediverse-radio
4 months, 1 week ago
@LeSuisse dismissed 4 months, 1 week ago

Dive allows One-click Remote Code Execution through Deep Links for MCP Install

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’s machine. This vulnerability is fixed in 0.13.0.

References

https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-pjj5-f3wm-f9m8 x_refsource_CONFIRM
https://github.com/OpenAgentPlatform/Dive/commit/a5162ac9eff366d8ea1215b8a47139a81a55a779 x_refsource_MISC

Affected products

Dive

==< 0.13.0

Ignored packages (7)

pkgs.dive

Tool for exploring each layer in a docker image

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1

pkgs.git-dive

Dive into a file's history to find root cause

nixos-unstable 0.1.6
- nixpkgs-unstable 0.1.6
- nixos-unstable-small 0.1.6

pkgs.libdivecomputer

Cross-platform and open source library for communication with dive computers from various manufacturers

nixos-unstable 0.9.0
- nixpkgs-unstable 0.9.0
- nixos-unstable-small 0.9.0

pkgs.haskellPackages.diversity

Quantify the diversity of a population

nixos-unstable 0.8.1.0
- nixpkgs-unstable 0.8.1.0
- nixos-unstable-small 0.8.1.0

pkgs.haskellPackages.data-diverse

Extensible records and polymorphic variants

nixos-unstable 4.7.1.0
- nixpkgs-unstable 4.7.1.0
- nixos-unstable-small 4.7.1.0

pkgs.typstPackages.diverential_0_2_0

Format differentials conveniently

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0

pkgs.gnomeExtensions.the-indie-beat-fediverse-radio

Stream The Indie Beat Radio - independent music from artists in the Fediverse.

nixos-unstable 9
- nixpkgs-unstable 9
- nixos-unstable-small 9

OpenAgentPlatform/Dive is not present in nixpkgs

Suggestion detail