Nixpkgs security tracker
5.1 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): Active (A)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): Low (L)
- Subsequent System Impact Integrity (SI): Low (L)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Active (A)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Low (L)
- Modified Subsequent System Impact Integrity (MSI): Low (L)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
19 packages
- gravit
- antigravity
- antigravity-cli
- antigravity-fhs
- antigravity-ide
- antigravity-ide-fhs
- stardust-xr-gravity
- kdePackages.libgravatar
- bulwark-plugins.gravatar
- gnomeExtensions.gravatar
- haskellPackages.gravatar
- python313Packages.libgravatar
- python314Packages.libgravatar
- python313Packages.flask-gravatar
- python314Packages.flask-gravatar
- python313Packages.django-gravatar2
- python314Packages.django-gravatar2
- perlPackages.MojoliciousPluginGravatar
- perl5Packages.MojoliciousPluginGravatar
- @LeSuisse accepted
- @LeSuisse published on GitHub
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.
References
-
GitHub Security Advisory (GHSA-752r-88j4-vxm3) vendor-advisory
-
VulnCheck Advisory: Grav Admin before 2.0.20 Cross-Site Scripting via marked.js third-party-advisory
Affected products
- <2.0.20
- ==2.0.20
Matching in nixpkgs
Ignored packages (19)
pkgs.gravit
Beautiful OpenGL-based gravity simulator
pkgs.antigravity
Agentic development platform, evolving the IDE into the agent-first era
pkgs.antigravity-cli
Google's Go-based terminal user interface (TUI) agent client
pkgs.antigravity-fhs
Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications
pkgs.antigravity-ide
Agentic development platform, evolving the IDE into the agent-first era
-
nixos-unstable -
- nixos-unstable-small 2.5.5
pkgs.antigravity-ide-fhs
Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications
-
nixos-unstable -
- nixos-unstable-small 2.5.5
pkgs.stardust-xr-gravity
Utility to launch apps and stardust clients at an offset
-
nixos-unstable 0-unstable-2024-12-29
- nixpkgs-unstable 0-unstable-2024-12-29
- nixos-unstable-small 0.51.1
-
nixos-26.05 0-unstable-2024-12-29
- nixos-26.05-small 0.51.1
- nixpkgs-26.05-darwin 0-unstable-2024-12-29
pkgs.kdePackages.libgravatar
Library that provides Gravatar support
pkgs.bulwark-plugins.gravatar
Resolves Gravatar profile pictures for email contacts via the avatar transform hook
-
nixos-unstable -
- nixos-unstable-small 1.3.1
pkgs.gnomeExtensions.gravatar
Synchronize GNOME Shell user icon with an avatar service, one of Gravatar or Libravatar.
pkgs.haskellPackages.gravatar
Generate Gravatar image URLs
pkgs.python313Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python314Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python313Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python314Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python313Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.python314Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.perlPackages.MojoliciousPluginGravatar
Globally Recognized Avatars for Mojolicious
Package maintainers
-
@rycee Robert Helgesson <robert@rycee.net>