Nixpkgs security tracker
9.8 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
9 packages
- librclone
- rclone-ui
- syncrclone
- rclone-browser
- git-annex-remote-rclone
- gnomeExtensions.rclone-manager
- python312Packages.rclone-python
- python313Packages.rclone-python
- python314Packages.rclone-python
- @LeSuisse ignored maintainer @SuperSandro2000 maintainer.ignore
- @LeSuisse accepted
- @LeSuisse published on GitHub
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
References
-
https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv x_refsource_CONFIRM
Affected products
- ==>= 1.46.0, < 1.74.3
Matching in nixpkgs
Ignored packages (9)
pkgs.librclone
Rclone as a C library
pkgs.rclone-ui
Cross-platform desktop GUI for rclone & S3
pkgs.syncrclone
Bidirectional sync tool for rclone
-
nixos-unstable 0-unstable-2023-03-23
- nixpkgs-unstable 0-unstable-2023-03-23
- nixos-unstable-small 0-unstable-2023-03-23
-
nixos-26.05 0-unstable-2023-03-23
- nixos-26.05-small 0-unstable-2023-03-23
- nixpkgs-26.05-darwin 0-unstable-2023-03-23
pkgs.rclone-browser
Graphical Frontend to Rclone written in Qt
pkgs.git-annex-remote-rclone
Use rclone supported cloud storage providers with git-annex
pkgs.gnomeExtensions.rclone-manager
Is like Dropbox sync client but for more than 30 services, adds an indicator to the top panel so you can manage the rclone profiles configured in your system, perform operations such as mount as remote, watch for file modifications, sync with remote storage, navigate it's main folder. Also, it shows the status of each profile so you can supervise the operations, and provides an easy access log of events. Backup and restore the rclone configuration file, so you won't have to configure all your devices one by one
pkgs.python312Packages.rclone-python
None
pkgs.python313Packages.rclone-python
Python wrapper for rclone
Package maintainers
Ignored maintainers (1)
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>