Nixpkgs security tracker
5.1 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Passive (P)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): Low (L)
- Subsequent System Impact Integrity (SI): Low (L)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Passive (P)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Low (L)
- Modified Subsequent System Impact Integrity (MSI): Low (L)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
19 packages
- haskellPackages.gravatar
- gravit
- antigravity
- antigravity-cli
- antigravity-fhs
- antigravity-ide
- antigravity-ide-fhs
- stardust-xr-gravity
- kdePackages.libgravatar
- bulwark-plugins.gravatar
- gnomeExtensions.gravatar
- python313Packages.libgravatar
- python314Packages.libgravatar
- python314Packages.flask-gravatar
- python313Packages.django-gravatar2
- python313Packages.flask-gravatar
- python314Packages.django-gravatar2
- perlPackages.MojoliciousPluginGravatar
- perl5Packages.MojoliciousPluginGravatar
- @LeSuisse accepted
- @LeSuisse published on GitHub
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
References
-
GitHub Security Advisory (GHSA-8hgv-xc77-jmcr) vendor-advisory
-
VulnCheck Advisory: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox third-party-advisory
Affected products
- <2.0.20
- ==2.0.20
Matching in nixpkgs
Ignored packages (19)
pkgs.gravit
Beautiful OpenGL-based gravity simulator
pkgs.antigravity
Agentic development platform, evolving the IDE into the agent-first era
pkgs.antigravity-cli
Google's Go-based terminal user interface (TUI) agent client
pkgs.antigravity-fhs
Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications
pkgs.antigravity-ide
Agentic development platform, evolving the IDE into the agent-first era
-
nixos-unstable -
- nixos-unstable-small 2.5.5
pkgs.antigravity-ide-fhs
Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications
-
nixos-unstable -
- nixos-unstable-small 2.5.5
pkgs.stardust-xr-gravity
Utility to launch apps and stardust clients at an offset
-
nixos-unstable 0-unstable-2024-12-29
- nixpkgs-unstable 0-unstable-2024-12-29
- nixos-unstable-small 0.51.1
-
nixos-26.05 0-unstable-2024-12-29
- nixos-26.05-small 0.51.1
- nixpkgs-26.05-darwin 0-unstable-2024-12-29
pkgs.kdePackages.libgravatar
Library that provides Gravatar support
pkgs.bulwark-plugins.gravatar
Resolves Gravatar profile pictures for email contacts via the avatar transform hook
-
nixos-unstable -
- nixos-unstable-small 1.3.1
pkgs.gnomeExtensions.gravatar
Synchronize GNOME Shell user icon with an avatar service, one of Gravatar or Libravatar.
pkgs.haskellPackages.gravatar
Generate Gravatar image URLs
pkgs.python313Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python314Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python313Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python314Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python313Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.python314Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.perlPackages.MojoliciousPluginGravatar
Globally Recognized Avatars for Mojolicious
Package maintainers
-
@rycee Robert Helgesson <robert@rycee.net>