Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-30242
8.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 2 weeks, 2 days ago by @mweinelt Activity log
  • Created automatic suggestion 2 weeks, 2 days ago
  • @mweinelt removed
    35 packages
    • xplanet
    • freeplane
    • m2-planet
    • crossplane
    • microplane
    • paper-plane
    • invoiceplane
    • m2-mesoplanet
    • crossplane-cli
    • biplanes-revival
    • planetary_annihilation
    • perlPackages.MathPlanePath
    • perl5Packages.MathPlanePath
    • dprint-plugins.g-plane-malva
    • python312Packages.crossplane
    • python313Packages.crossplane
    • python314Packages.crossplane
    • perl538Packages.MathPlanePath
    • perl540Packages.MathPlanePath
    • dprint-plugins.g-plane-markup_fmt
    • dprint-plugins.g-plane-pretty_yaml
    • gnomeExtensions.sane-airplane-mode
    • python313Packages.envoy-data-plane
    • python314Packages.envoy-data-plane
    • python312Packages.planetary-computer
    • python313Packages.planetary-computer
    • python314Packages.planetary-computer
    • dprint-plugins.g-plane-pretty_graphql
    • haskellPackages.amazonka-iot-dataplane
    • python313Packages.greenplanet-energy-api
    • python314Packages.greenplanet-energy-api
    • haskellPackages.amazonka-iot-jobs-dataplane
    • vscode-extensions.gplane.wasm-language-tools
    • haskellPackages.amazonka-mediastore-dataplane
    • tests.home-assistant-component-tests.green_planet_energy
    2 weeks, 2 days ago
  • @mweinelt dismissed 2 weeks, 2 days ago
Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.

References

Affected products

plane
  • ==< 1.2.3
Ignored packages (35)

pkgs.invoiceplane

Self-hosted open source application for managing your invoices, clients and payments

pkgs.gnomeExtensions.sane-airplane-mode

Make airplane mode sane again! This extension gives you better control over the airplane mode and lets you turn off the annoying "Bluetooth gets turned on when I disable airplane mode" behaviour.

Not in nixpkgs