Nixpkgs security tracker
NIXPKGS-2026-1835
GitHub issue
published on
Permalink
CVE-2026-10268
1.9 LOW
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): POC (P)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored
-
@LeSuisse
ignored
6 packages
- python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
- python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
- python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
- tree-sitter-grammars.tree-sitter-janet-simple
- vscode-extensions.janet-lang.vscode-janet
- vimPlugins.nvim-treesitter-parsers.janet_simple
- @LeSuisse accepted
- @LeSuisse published on GitHub
janet-lang janet marsh.c unmarshal_one_fiber integer overflow
A weakness has been identified in janet-lang janet up to 1.41.0. This vulnerability affects the function unmarshal_one_fiber of the file src/core/marsh.c. Executing a manipulation can lead to integer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d9b1d711ea1fde52ac73a82088b512a3e17bad0d. A patch should be applied to remediate this issue.
References
-
VDB-367547 | janet-lang janet marsh.c unmarshal_one_fiber integer overflow vdb-entrytechnical-description
-
https://github.com/janet-lang/janet/issues/1744 issue-tracking
Ignored references (4)
-
CVE-2026-10268 | CVE Analysis and Report third-party-advisory
-
-
Submit #825075 | janet-lang janet 1.41.0 Integer Overflow third-party-advisory
Affected products
janet
- ==1.26
- ==1.34
- ==1.15
- ==1.19
- ==1.10
- ==1.38
- ==1.28
- ==1.33
- ==1.18
- ==1.20
- ==1.6
- ==1.39
- ==1.40
- ==1.3
- ==1.1
- ==1.31
- ==1.27
- ==1.35
- ==1.36
- ==1.24
- ==1.11
- ==1.22
- ==1.25
- ==1.8
- ==1.29
- ==1.5
- ==1.12
- ==1.30
- ==1.13
- ==1.17
- ==1.4
- ==1.16
- ==1.21
- ==1.14
- ==1.0
- ==1.7
- ==1.2
- ==1.9
- ==1.41.0
- ==1.32
- ==1.37
- ==1.23
Matching in nixpkgs
Ignored packages (6)
pkgs.vscode-extensions.janet-lang.vscode-janet
Janet language support for Visual Studio Code
pkgs.tree-sitter-grammars.tree-sitter-janet-simple
Tree-sitter grammar for janet-simple
-
nixos-unstable 0.0.7-unstable-2025-05-19
- nixpkgs-unstable 0.0.7-unstable-2025-05-19
- nixos-unstable-small 0.0.7-unstable-2025-05-19
pkgs.vimPlugins.nvim-treesitter-parsers.janet_simple
Tree-sitter grammar for janet_simple
-
nixos-unstable 0.0.0+rev=d183186
- nixpkgs-unstable 0.0.0+rev=d183186
- nixos-unstable-small 0.0.0+rev=d183186
pkgs.python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
Python bindings for tree-sitter-janet-simple
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
Python bindings for tree-sitter-janet-simple
-
nixos-unstable 0.0.7+unstable20250519
- nixpkgs-unstable 0.0.7+unstable20250519
- nixos-unstable-small 0.0.7+unstable20250519
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
Python bindings for tree-sitter-janet-simple
-
nixos-unstable 0.0.7+unstable20250519
- nixpkgs-unstable 0.0.7+unstable20250519
- nixos-unstable-small 0.0.7+unstable20250519
Package maintainers
-
@peterhoeg Peter Hoeg <peter@hoeg.com>