Nixpkgs security tracker
8.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
12 packages
- speech-denoiser
- openimagedenoise
- terraform-providers.deno
- python312Packages.denonavr
- python313Packages.denonavr
- haskellPackages.pandoc-sidenote
- terraform-providers.denoland_deno
- gnomeExtensions.denon-avr-controler
- python312Packages.bnunicodenormalizer
- python313Packages.bnunicodenormalizer
- vscode-extensions.denoland.vscode-deno
- home-assistant-component-tests.denonavr
- @LeSuisse dismissed
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.
References
-
https://github.com/denoland/deno/security/advisories/GHSA-m3c4-prhw-mrx6 x_refsource_CONFIRM
-
https://github.com/denoland/deno/releases/tag/v2.5.6 x_refsource_MISC
Affected products
- ==< 2.5.6
Matching in nixpkgs
Ignored packages (12)
pkgs.speech-denoiser
Speech denoise lv2 plugin based on RNNoise library
-
nixos-unstable 0-unstable-2018-10-08
- nixpkgs-unstable 0-unstable-2018-10-08
- nixos-unstable-small 0-unstable-2018-10-08
pkgs.openimagedenoise
High-Performance Denoising Library for Ray Tracing
pkgs.terraform-providers.deno
None
pkgs.python312Packages.denonavr
Automation Library for Denon AVR receivers
pkgs.python313Packages.denonavr
Automation Library for Denon AVR receivers
pkgs.haskellPackages.pandoc-sidenote
Convert Pandoc Markdown-style footnotes into sidenotes
pkgs.terraform-providers.denoland_deno
None
pkgs.gnomeExtensions.denon-avr-controler
Denon AVR controler
pkgs.python312Packages.bnunicodenormalizer
Bangla Unicode Normalization Toolkit
pkgs.python313Packages.bnunicodenormalizer
Bangla Unicode Normalization Toolkit
pkgs.vscode-extensions.denoland.vscode-deno
Language server client for Deno
pkgs.home-assistant-component-tests.denonavr
Open source home automation that puts local control and privacy first
Package maintainers
-
@ofalvai Olivér Falvai <ofalvai@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>