Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-33868
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 month, 3 weeks ago by @mweinelt Activity log
  • Created suggestion 1 month, 3 weeks ago
  • @mweinelt ignored
    11 packages
    • mastodon-bot
    • bitlbee-mastodon
    • mastodon-archive
    • nodePackages.mastodon-bot
    • python312Packages.mastodon-py
    • python313Packages.mastodon-py
    • python314Packages.mastodon-py
    • nodePackages_latest.mastodon-bot
    • home-assistant-component-tests.mastodon
    • tests.home-assistant-component-tests.mastodon
    • wordpressPackages.plugins.simple-mastodon-verification
    1 month, 3 weeks ago
  • @mweinelt dismissed 1 month, 3 weeks ago
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

Affected products

mastodon
  • ==< 4.3.21
  • ==>= 4.5.0, < 4.5.8
  • ==>= 4.4.0, < 4.4.15

Matching in nixpkgs

pkgs.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

Ignored packages (11)

pkgs.mastodon-bot

Bot to publish twitter, tumblr or rss posts to an mastodon account.

Package maintainers

Fixed in https://github.com/nixos/nixpkgs/pull/503089.