Nixpkgs Security Tracker

Dismissed

Permalink CVE-2019-25317

updated 6 days, 13 hours ago by @LeSuisse Activity log

Created automatic suggestion 1 week, 2 days ago
@LeSuisse dismissed 6 days, 13 hours ago

Kimai 2- persistent cross-site scripting (XSS)

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Affected products

Kimai

Matching in nixpkgs

pkgs.kimai

Web-based multi-user time-tracking application

nixos-unstable 2.47.0
- nixpkgs-unstable 2.47.0
- nixos-unstable-small 2.47.0
nixos-25.11 2.46.0
- nixos-25.11-small 2.46.0
- nixpkgs-25.11-darwin 2.46.0

Package maintainers

@peat-psuwit Ratchanan Srirattanamet <peat@peat-network.xyz>

Upstream patch: https://github.com/kimai/kimai/commit/a0e8aa3a435717187fb12210242dab1b7c97ff3f

Current stable branch was never impacted.

Suggestion detail

Affected products

Matching in nixpkgs

pkgs.kimai

Package maintainers