Nixpkgs security tracker

Untriaged

Permalink CVE-2026-12436

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

created 6 days, 13 hours ago Activity log

Created suggestion 6 days, 13 hours ago

Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/603223
HackerOne Bug Bounty Report #3800511 permissions-requiredexploittechnical-description
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/

Affected products

GitLab

<19.1.3
<19.2.1
<19.0.5

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 18.11.7
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.7
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ee

GitLab Enterprise Edition

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 18.11.7
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.7
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

nixos-unstable 8.89.0
- nixpkgs-unstable 8.89.0
- nixos-unstable-small 9.3.0
nixos-26.05 8.89.0
- nixos-26.05-small 8.89.0
- nixpkgs-26.05-darwin 8.89.0

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

nixos-unstable 18.6.3
- nixpkgs-unstable 18.6.3
- nixos-unstable-small 18.6.3
nixos-26.05 18.6.3
- nixos-26.05-small 18.6.3
- nixpkgs-26.05-darwin 18.6.3

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.3
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 18.11.7
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.7
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-shell

SSH access and repository management app for GitLab

nixos-unstable 14.50.0
- nixpkgs-unstable 14.50.0
- nixos-unstable-small 14.50.0
nixos-26.05 14.50.0
- nixos-26.05-small 14.50.0
- nixpkgs-26.05-darwin 14.50.0

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

nixos-unstable 10.0.0
- nixpkgs-unstable 10.0.0
- nixos-unstable-small 10.0.0
nixos-26.05 10.0.0
- nixos-26.05-small 10.0.0
- nixpkgs-26.05-darwin 10.0.0

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

nixos-unstable 19.0.0
- nixpkgs-unstable 19.0.0
- nixos-unstable-small 19.1.1
nixos-26.05 18.11.3
- nixos-26.05-small 18.11.3
- nixpkgs-26.05-darwin 18.11.3

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

nixos-unstable 1.50.0
- nixpkgs-unstable 1.51.0
- nixos-unstable-small 1.51.0
nixos-26.05 1.50.0
- nixos-26.05-small 1.51.0
- nixpkgs-26.05-darwin 1.50.0

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

nixos-unstable 4.64.1
- nixpkgs-unstable 4.64.1
- nixos-unstable-small 4.73.0
nixos-26.05 4.64.1
- nixos-26.05-small 4.64.1
- nixpkgs-26.05-darwin 4.64.1

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

nixos-unstable 0.7.1
- nixpkgs-unstable 0.7.1
- nixos-unstable-small 0.7.1
nixos-26.05 0.7.1
- nixos-26.05-small 0.7.1
- nixpkgs-26.05-darwin 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.4.0
- nixos-26.05-small 2.4.0
- nixpkgs-26.05-darwin 2.4.0

pkgs.gitlab-workhorse

None

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 18.11.7
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.7
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

nixos-unstable -
- nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

nixos-unstable 0.24.0
- nixpkgs-unstable 0.24.0
- nixos-unstable-small 0.24.0
nixos-26.05 0.24.0
- nixos-26.05-small 0.24.0
- nixpkgs-26.05-darwin 0.24.0

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-container-registry

GitLab Docker toolset to pack, ship, store, and deliver content

nixos-unstable 4.39.0
- nixpkgs-unstable 4.39.0
- nixos-unstable-small 4.39.0
nixos-26.05 4.39.0
- nixos-26.05-small 4.39.0
- nixpkgs-26.05-darwin 4.39.0

pkgs.ocamlPackages.gitlab-jsoo

Gitlab APIv4 JavaScript library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.ocamlPackages.gitlab-unix

Gitlab APIv4 Unix library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.rubyPackages.gitlab-markup

None

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0
nixos-26.05 2.0.0
- nixos-26.05-small 2.0.0
- nixpkgs-26.05-darwin 2.0.0

pkgs.terraform-providers.gitlab

None

nixos-unstable 19.1.0
- nixpkgs-unstable 19.1.0
nixos-26.05 18.11.0
- nixos-26.05-small 18.11.0
- nixpkgs-26.05-darwin 18.11.0

pkgs.ocamlPackages_latest.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-elasticsearch-indexer

Indexes Git repositories into Elasticsearch for GitLab

nixos-unstable 5.14.7
- nixpkgs-unstable 5.14.7
- nixos-unstable-small 5.14.7
nixos-26.05 5.14.7
- nixos-26.05-small 5.14.7
- nixpkgs-26.05-darwin 5.14.7

pkgs.haskellPackages.gitlab-haskell

A Haskell library for the GitLab web API

nixos-unstable 1.1.0.0
- nixpkgs-unstable 1.1.0.0
- nixos-unstable-small 1.1.0.0
nixos-26.05 1.1.0.0
- nixos-26.05-small 1.1.0.0
- nixpkgs-26.05-darwin 1.1.0.0