Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0262

NIXPKGS-2026-0262
published on 17 Feb 2026
Permalink CVE-2026-1046
updated 4 days, 3 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 4 days, 18 hours ago
  • @LeSuisse removed
    4 packages
    • mattermost-desktop
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    4 days, 4 hours ago
  • @LeSuisse removed
    5 maintainers
    • @fsagbuya
    • @Kranzes
    • @numinit
    • @mgdelacroix
    • @ryantm
    4 days, 3 hours ago
  • @LeSuisse accepted 4 days, 3 hours ago
  • @LeSuisse published on GitHub 4 days, 3 hours ago
Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

Affected products

Mattermost
  • =<5.2.13
  • ==6.1.0
  • ==5.13.3.0
  • ==6.0.3.0
  • =<6.2.0

Matching in nixpkgs

Package maintainers

Ignored maintainers (5) 
Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561