Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-90715
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 1 week ago Activity log
  • Created suggestion 1 week ago
marcobambini Gravity udp json-parser gravity_json.c integer overflow

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.

Affected products

Gravity
  • ==0.9.5
  • ==0.9.0
  • ==0.9.7
  • ==0.9.8
  • ==0.9.1
  • ==0.9.2
  • ==0.9.4
  • ==0.9.3
  • ==0.9.6

Matching in nixpkgs

pkgs.antigravity

Agentic development platform, evolving the IDE into the agent-first era

  • nixos-unstable -
    • nixos-unstable-small 2.5.5
  • nixos-26.05 -

pkgs.antigravity-acp

Google's AI coding agent. Official ACP server powered by Antigravity

  • nixos-unstable -
    • nixos-unstable-small 1.1.1

pkgs.antigravity-cli

Google's Go-based terminal user interface (TUI) agent client

  • nixos-unstable -
    • nixos-unstable-small 1.2.3

pkgs.antigravity-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

  • nixos-unstable -
    • nixos-unstable-small 2.5.5
  • nixos-26.05 -

pkgs.antigravity-hub

Desktop environment for managing multiple autonomous agents across independent projects

  • nixos-unstable -

pkgs.antigravity-ide

Agentic development platform, evolving the IDE into the agent-first era

  • nixos-unstable -
    • nixos-unstable-small 2.5.5

pkgs.antigravity-ide-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

  • nixos-unstable -
    • nixos-unstable-small 2.5.5

pkgs.stardust-xr-gravity

Utility to launch apps and stardust clients at an offset

  • nixos-unstable -
  • nixos-26.05 -