Nixpkgs security tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-4802
8.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 2 days, 3 hours ago Activity log
  • Created suggestion
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Affected products

cockpit

Matching in nixpkgs

pkgs.cockpit

Web-based graphical interface for servers

  • nixos-unstable 360
    • nixpkgs-unstable 361
    • nixos-unstable-small 361
  • nixos-25.11 351
    • nixos-25.11-small 351
    • nixpkgs-25.11-darwin 351

pkgs.cockpit-files

Featureful file browser for Cockpit

  • nixos-unstable 39
    • nixpkgs-unstable 39
    • nixos-unstable-small 40

pkgs.cockpit-podman

Cockpit UI for podman containers

  • nixos-unstable 124
    • nixpkgs-unstable 124
    • nixos-unstable-small 125

Package maintainers