NIXPKGS-2026-1026
GitHub issue
published on
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package python312Packages.zammad-py
- @LeSuisse removed package python313Packages.zammad-py
- @LeSuisse removed package python314Packages.zammad-py
- @LeSuisse accepted
- @LeSuisse published on GitHub
Zammad improperly neutralizes of script-related HTML tags in ticket articles
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.
References
-
https://github.com/zammad/zammad/security/advisories/GHSA-c2cf-9fc7-jhf3 x_refsource_CONFIRM
Affected products
zammad
- ==< 6.5.4
- ==>= 7.0.0-alpha, < 7.0.1
Matching in nixpkgs
Ignored packages (3)
pkgs.python312Packages.zammad-py
Python API client for accessing zammad REST API
pkgs.python313Packages.zammad-py
Python API client for accessing zammad REST API
pkgs.python314Packages.zammad-py
Python API client for accessing zammad REST API
Package maintainers
-
@NetaliDev Jennifer Graul <me@netali.de>
-
@Radvendii Taeer Bar-Yam <taeer@necsi.edu>