NIXPKGS-2026-2269

Permalink CVE-2026-64800

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains GoLand before 2026.2 sensitive configuration values written to …

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

GoLand

<2026.2

Matching in nixpkgs

pkgs.jetbrains.goland

Go IDE from JetBrains

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.2
- nixos-26.05-small 2026.1.4
- nixpkgs-26.05-darwin 2026.1.2

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@theCapypara Marco Köpcke <hello@capypara.de>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64807

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64808

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible …

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

PhpStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.phpstorm

PHP IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.4
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@jamesward James Ward <james@jamesward.com>
@tymscar Oscar Molnar <oscar@tymscar.com>
@leona-ya Leona Maroni <nix@leona.is>
@theCapypara Marco Köpcke <hello@capypara.de>

Permalink CVE-2026-64803

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains GoLand before 2026.2 arbitrary code execution was possible …

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

GoLand

<2026.2

Matching in nixpkgs

pkgs.jetbrains.goland

Go IDE from JetBrains

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.2
- nixos-26.05-small 2026.1.4
- nixpkgs-26.05-darwin 2026.1.2

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@theCapypara Marco Köpcke <hello@capypara.de>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64804

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-65908

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via …

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

PyCharm

<2026.1.4, 2026.2

Matching in nixpkgs

pkgs.jetbrains.pycharm

Python IDE from JetBrains

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.2
- nixos-26.05-small 2026.1.2
- nixpkgs-26.05-darwin 2026.1.2

pkgs.jetbrains.pycharm-oss

Free Python IDE from JetBrains (built from source)

nixos-unstable 2025.3.3
- nixpkgs-unstable 2025.3.3
- nixos-unstable-small 2025.3.3
nixos-26.05 2025.3.3
- nixos-26.05-small 2025.3.3
- nixpkgs-26.05-darwin 2025.3.3

Package maintainers

@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64805

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64802

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 5 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains GoLand before 2026.2 arbitrary code execution was possible …

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

GoLand

<2026.2

Matching in nixpkgs

pkgs.jetbrains.goland

Go IDE from JetBrains

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.2
- nixos-26.05-small 2026.1.4
- nixpkgs-26.05-darwin 2026.1.2

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@theCapypara Marco Köpcke <hello@capypara.de>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64809

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 6 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible …

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

PhpStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.phpstorm

PHP IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.4
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@jamesward James Ward <james@jamesward.com>
@tymscar Oscar Molnar <oscar@tymscar.com>
@leona-ya Leona Maroni <nix@leona.is>
@theCapypara Marco Köpcke <hello@capypara.de>

Permalink CVE-2026-64806

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

Created suggestion 20 hours ago
@LeSuisse accepted 6 hours ago
@LeSuisse published on GitHub 5 hours ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Details of issue NIXPKGS-2026-2269

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.goland

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.phpstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.goland

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.pycharm

pkgs.jetbrains.pycharm-oss

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.goland

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.phpstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers