Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-3855
3.1 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 5 days, 12 hours ago Activity log
  • Created suggestion 5 days, 12 hours ago
Improper Control of Resource Identifiers ('Resource Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload functionality.

Affected products

GitLab
  • <19.3.2
  • <19.2.6
  • <19.1.8

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ee

GitLab Enterprise Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

  • nixos-unstable -
    • nixos-unstable-small 0.5.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

  • nixos-unstable -
    • nixos-unstable-small 9.6.0
  • nixos-26.05 -

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

  • nixos-unstable -
    • nixos-unstable-small 1.4.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-shell

SSH access and repository management app for GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

  • nixos-unstable -
    • nixos-unstable-small 1.0.3
  • nixos-26.05 -
    • nixos-26.05-small 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

  • nixos-unstable -
    • nixos-unstable-small 0.7.1
  • nixos-26.05 -
    • nixos-26.05-small 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

  • nixos-unstable -
    • nixos-unstable-small 2.4.0
  • nixos-26.05 -
    • nixos-26.05-small 2.4.0

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

  • nixos-unstable -
    • nixos-unstable-small 0.1.8
  • nixos-26.05 -
    • nixos-26.05-small 0.1.8

Package maintainers