Nixpkgs security tracker

Untriaged

Permalink CVE-2026-19650

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/612617
HackerOne Bug Bounty Report #3903669 technical-descriptionpermissions-requiredexploit
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/

Affected products

GitLab

<19.1.6
<19.2.4
<18.11.11
<19.0.8

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ee

GitLab Enterprise Edition

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

nixos-unstable 8.89.0
- nixpkgs-unstable 8.89.0
- nixos-unstable-small 9.6.0
nixos-26.05 8.89.0
- nixos-26.05-small 8.89.0
- nixpkgs-26.05-darwin 8.89.0

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

nixos-unstable 18.6.3
- nixpkgs-unstable 18.6.3
- nixos-unstable-small 18.6.3
nixos-26.05 18.6.3
- nixos-26.05-small 18.6.3
- nixpkgs-26.05-darwin 18.6.3

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.4
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-shell

SSH access and repository management app for GitLab

nixos-unstable 14.50.0
- nixpkgs-unstable 14.50.0
- nixos-unstable-small 14.51.0
nixos-26.05 14.50.0
- nixos-26.05-small 14.51.0
- nixpkgs-26.05-darwin 14.50.0

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

nixos-unstable 10.0.0
- nixpkgs-unstable 10.0.0
- nixos-unstable-small 10.0.0
nixos-26.05 10.0.0
- nixos-26.05-small 10.0.0
- nixpkgs-26.05-darwin 10.0.0

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

nixos-unstable 19.0.0
- nixpkgs-unstable 19.0.0
- nixos-unstable-small 19.1.1
nixos-26.05 18.11.3
- nixos-26.05-small 18.11.3
- nixpkgs-26.05-darwin 18.11.3

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

nixos-unstable 1.50.0
- nixpkgs-unstable 1.51.0
- nixos-unstable-small 1.51.0
nixos-26.05 1.50.0
- nixos-26.05-small 1.51.0
- nixpkgs-26.05-darwin 1.50.0

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

nixos-unstable 4.64.1
- nixpkgs-unstable 4.64.1
- nixos-unstable-small 4.74.0
nixos-26.05 4.64.1
- nixos-26.05-small 4.64.1
- nixpkgs-26.05-darwin 4.64.1

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

nixos-unstable 0.7.1
- nixpkgs-unstable 0.7.1
- nixos-unstable-small 0.7.1
nixos-26.05 0.7.1
- nixos-26.05-small 0.7.1
- nixpkgs-26.05-darwin 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.4.0
- nixos-26.05-small 2.4.0
- nixpkgs-26.05-darwin 2.4.0

pkgs.gitlab-workhorse

None

nixos-unstable 18.11.6
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

nixos-unstable -
- nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

nixos-unstable 0.24.0
- nixpkgs-unstable 0.24.0
- nixos-unstable-small 0.24.0
nixos-26.05 0.24.0
- nixos-26.05-small 0.24.0
- nixpkgs-26.05-darwin 0.24.0

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-container-registry

GitLab Docker toolset to pack, ship, store, and deliver content

nixos-unstable 4.39.0
- nixpkgs-unstable 4.39.0
- nixos-unstable-small 4.40.2
nixos-26.05 4.39.0
- nixos-26.05-small 4.40.2
- nixpkgs-26.05-darwin 4.39.0

pkgs.ocamlPackages.gitlab-jsoo

Gitlab APIv4 JavaScript library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.ocamlPackages.gitlab-unix

Gitlab APIv4 Unix library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.rubyPackages.gitlab-markup

None

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0
nixos-26.05 2.0.0
- nixos-26.05-small 2.0.0
- nixpkgs-26.05-darwin 2.0.0

pkgs.terraform-providers.gitlab

None

nixos-unstable 19.1.0
- nixpkgs-unstable 19.1.0
nixos-26.05 18.11.0
- nixos-26.05-small 18.11.0
- nixpkgs-26.05-darwin 18.11.0

pkgs.ocamlPackages_latest.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-elasticsearch-indexer

Indexes Git repositories into Elasticsearch for GitLab

nixos-unstable 5.14.7
- nixpkgs-unstable 5.14.7
- nixos-unstable-small 5.14.7
nixos-26.05 5.14.7
- nixos-26.05-small 5.14.7
- nixpkgs-26.05-darwin 5.14.7

pkgs.haskellPackages.gitlab-haskell

A Haskell library for the GitLab web API

nixos-unstable 1.1.0.0
- nixpkgs-unstable 1.1.0.0
- nixos-unstable-small 1.1.0.0
nixos-26.05 1.1.0.0
- nixos-26.05-small 1.1.0.0
- nixpkgs-26.05-darwin 1.1.0.0