Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1844

NIXPKGS-2026-1844
published on
Permalink CVE-2026-10267
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 3 hours ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored
    3 references
    4 hours ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    4 hours ago
  • @LeSuisse accepted 4 hours ago
  • @LeSuisse published on GitHub 3 hours ago
janet-lang janet debug.c doframe out-of-bounds

A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.

Affected products

janet
  • ==1.26
  • ==1.34
  • ==1.15
  • ==1.19
  • ==1.10
  • ==1.38
  • ==1.28
  • ==1.33
  • ==1.18
  • ==1.20
  • ==1.6
  • ==1.39
  • ==1.40
  • ==1.3
  • ==1.1
  • ==1.31
  • ==1.27
  • ==1.35
  • ==1.36
  • ==1.24
  • ==1.11
  • ==1.22
  • ==1.25
  • ==1.8
  • ==1.29
  • ==1.5
  • ==1.12
  • ==1.30
  • ==1.13
  • ==1.17
  • ==1.4
  • ==1.16
  • ==1.21
  • ==1.14
  • ==1.0
  • ==1.7
  • ==1.2
  • ==1.9
  • ==1.41.0
  • ==1.32
  • ==1.37
  • ==1.23

Matching in nixpkgs

Ignored packages (6)

Package maintainers