Nixpkgs security tracker
5.3 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
mport trusts environment-controlled temporary directories in privileged metadata extraction
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
References
-
https://github.com/MidnightBSD/mport/security/advisories/GHSA-4vv3-3h8r-q6mq x_refsource_CONFIRM
-
https://github.com/MidnightBSD/mport/pull/123 x_refsource_MISC
-
https://github.com/MidnightBSD/mport/releases/tag/2.7.8 x_refsource_MISC
Affected products
- ==< 2.7.8
Matching in nixpkgs
pkgs.ghp-import
Copy your docs directly to the gh-pages branch
pkgs.gosimports
Simpler goimports
pkgs.zigimports
Automatically remove unused imports and globals from Zig files
-
nixos-unstable -
- nixos-unstable-small 0.1.0-unstable-2026-07-25
-
nixos-26.05 -
- nixos-26.05-small 0.1.0
pkgs.ssh-import-id
Retrieves an SSH public key and installs it locally
pkgs.go-import-lint
Golang source code analyzer that checks imports order
pkgs.goimports-reviser
Right imports sorting & code formatting tool (goimports alternative)
pkgs.cargo-group-imports
Group imports in Rust workspaces
-
nixos-unstable -
- nixos-unstable-small 0.1.5
pkgs.inventree-part-import
CLI to import parts from suppliers like DigiKey, LCSC, Mouser, etc. to InvenTree
pkgs.perlPackages.Importer
Alternative but compatible interface to modules that export symbols
pkgs.perl5Packages.Importer
Alternative but compatible interface to modules that export symbols
pkgs.userborn-import-legacy
One-shot migration from update-users-groups.pl state to userborn
-
nixos-unstable -
- nixos-unstable-small 0.1.0
pkgs.perlPackages.ImportInto
Import packages into other packages
pkgs.kdePackages.mailimporter
Library that implements importing of emails from various other email clients
pkgs.leanPackages.importGraph
Tools to analyse and visualise Lean 4 import structures
-
nixos-unstable -
- nixos-unstable-small 4.30.0-unstable-2026-05-26
-
nixos-26.05 -
- nixos-26.05-small 4.29.0
pkgs.ocamlPackages.ppx_import
Syntax extension for importing declarations from interface files
pkgs.perl5Packages.ImportInto
Import packages into other packages
pkgs.firefly-iii-data-importer
Firefly III Data Importer can import data into Firefly III
pkgs.kdePackages.mbox-importer
Wizard to assist with importing MBox email archives into Akonadi
pkgs.passExtensions.pass-import
Pass extension for importing data from existing password managers
pkgs.python313Packages.importlab
Library that automatically infers dependencies for Python files
pkgs.python314Packages.importlab
Library that automatically infers dependencies for Python files
pkgs.haskellPackages.glob-imports
Import modules for metaprogramming
pkgs.python313Packages.fastimport
VCS fastimport/fastexport parser
pkgs.python313Packages.ghp-import
Copy your docs directly to the gh-pages branch
pkgs.python314Packages.fastimport
VCS fastimport/fastexport parser
pkgs.python314Packages.ghp-import
Copy your docs directly to the gh-pages branch
pkgs.python313Packages.findimports
Module for the analysis of Python import statements
pkgs.python313Packages.importmagic
Python Import Magic - automagically add, remove and manage imports
pkgs.python313Packages.localimport
Isolated import of Python modules
pkgs.python314Packages.findimports
Module for the analysis of Python import statements
pkgs.python314Packages.importmagic
Python Import Magic - automagically add, remove and manage imports
pkgs.python314Packages.localimport
Isolated import of Python modules
pkgs.python313Packages.lazy-imports
Utility package to create lazy modules, deferring associated imports until attribute access
pkgs.python314Packages.lazy-imports
Utility package to create lazy modules, deferring associated imports until attribute access
pkgs.ocamlPackages_latest.ppx_import
Syntax extension for importing declarations from interface files
pkgs.python313Packages.beanhub-import
Declarative idempotent rule-based Beancount transaction import engine in Python
pkgs.python313Packages.beets-ytimport
Beets plugin to import music from Youtube and SoundCloud
-
nixos-unstable -
- nixos-unstable-small 1.13.0
pkgs.python314Packages.beanhub-import
Declarative idempotent rule-based Beancount transaction import engine in Python
pkgs.python314Packages.beets-ytimport
Beets plugin to import music from Youtube and SoundCloud
-
nixos-unstable -
- nixos-unstable-small 1.13.0
pkgs.haskellPackages.normalize-imports
Sort and align Haskell import statements
pkgs.kdePackages.akonadi-import-wizard
Assistant to import external PIM data into Akonadi for use in KDE PIM apps
pkgs.azure-cli-extensions.import-export
Microsoft Azure Command-Line Tools StorageImportExport Extension
pkgs.haskellPackages.rivet-autoimporter
Database migration library; automatic importer
pkgs.python313Packages.classify-imports
Utilities for refactoring imports in python-like syntax
pkgs.python314Packages.classify-imports
Utilities for refactoring imports in python-like syntax
pkgs.python313Packages.auto-lazy-imports
Enable lazy imports using native python syntax
pkgs.python313Packages.import-expression
Transpiles a superset of python to allow easy inline imports
-
nixos-unstable -
- nixos-unstable-small 2.2.1.post1
-
nixos-26.05 -
- nixos-26.05-small 2.2.1.post1
pkgs.python314Packages.auto-lazy-imports
Enable lazy imports using native python syntax
pkgs.python314Packages.import-expression
Transpiles a superset of python to allow easy inline imports
-
nixos-unstable -
- nixos-unstable-small 2.2.1.post1
-
nixos-26.05 -
- nixos-26.05-small 2.2.1.post1
pkgs.haskellPackages.cointracking-imports
Generate CSV & XLSX files for importing into CoinTracking
pkgs.haskellPackages.amazonka-importexport
Amazon Import/Export SDK
-
nixos-unstable -
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-26.05 -
- nixos-26.05-small 2.0-unstable-2025-04-16
pkgs.python313Packages.beets-importreplace
Plugin for beets to perform regex replacements during import
-
nixos-unstable -
- nixos-unstable-small 0.3
pkgs.python313Packages.flake8-import-order
Flake8 and pylama plugin that checks the ordering of import statements
pkgs.python313Packages.importlib-resources
Read resources from Python packages
pkgs.python313Packages.zope-deferredimport
Allows you to perform imports names that will only be resolved when used in the code
pkgs.python314Packages.beets-importreplace
Plugin for beets to perform regex replacements during import
-
nixos-unstable -
- nixos-unstable-small 0.3
pkgs.python314Packages.flake8-import-order
Flake8 and pylama plugin that checks the ordering of import statements
pkgs.python314Packages.importlib-resources
Read resources from Python packages
pkgs.python314Packages.zope-deferredimport
Allows you to perform imports names that will only be resolved when used in the code
pkgs.python313Packages.django-import-export
Django application and library for importing and exporting data with admin integration
pkgs.python314Packages.django-import-export
Django application and library for importing and exporting data with admin integration
pkgs.python313Packages.pythonImportsCheckHook
None
pkgs.python313Packages.reorder-python-imports
Tool for automatically reordering python imports
pkgs.python314Packages.pythonImportsCheckHook
None
pkgs.python314Packages.reorder-python-imports
Tool for automatically reordering python imports
pkgs.vscode-extensions.wix.vscode-import-cost
None
pkgs.ankiAddons.anki-quizlet-importer-extended
Import Quizlet Decks into Anki
-
nixos-unstable -
- nixos-unstable-small 2026.06.08
-
nixos-26.05 -
- nixos-26.05-small 2026.01.17
pkgs.python313Packages.mypy-boto3-importexport
Type annotations for boto3 importexport
pkgs.python314Packages.mypy-boto3-importexport
Type annotations for boto3 importexport
pkgs.chickenPackages_5.chickenEggs.dynamic-import
Dynamic Import
pkgs.chickenPackages_6.chickenEggs.dynamic-import
Dynamic Import
-
nixos-unstable -
- nixos-unstable-small 1.4.2
pkgs.python313Packages.types-aiobotocore-importexport
Type annotations for aiobotocore importexport
pkgs.python314Packages.types-aiobotocore-importexport
Type annotations for aiobotocore importexport
-
nixos-unstable -
- nixos-unstable-small 3.9.1
Package maintainers
-
@ethancedwards8 Ethan Carter Edwards <ethan@ethancedwards.com>
-
@katexochen Paul Meyer <katexochen0@gmail.com>
-
@baloo Arthur Gautier <nixpkgs@superbaloo.net>
-
@savyajha Savyasachee Jha <savya.jha@hawkradius.com>
-
@veehaitch Vincent Haupert <mail@vincent-haupert.de>
-
@xiaoxiangmoe ZHAO JinXiang <xiaoxiangmoe@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@maolonglong Shaolong Chen <shaolong.chen@outlook.it>
-
@Gigahawk jasperchan515@gmail.com <Jasper Chan>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@K900 Ilya K. <me@0upti.me>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@nadja-y Nadja Yang <nadja@njy.dev>
-
@tadfisher Tad Fisher <tadfisher@gmail.com>
-
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
-
@pbsds Peder Bergebakken Sundt <pbsds@hotmail.com>
-
@fangpenlin Fang-Pen Lin <hello@fangpenlin.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@gador Florian Brandes <florian.brandes@posteo.de>
-
@sephii Sylvain Fankhauser <sephi@fhtagn.top>
-
@k0ral Koral <koral@mailoo.org>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@sei40kr Seong Yong-ju <sei40kr@gmail.com>
-
@onny Jonas Heinrich <onny@project-insanity.org>
-
@happysalada Raphael Megzari <raphael@megzari.com>
-
@viraptor Stanisław Pitucha <nix@viraptor.info>
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@R-VdP Ramses <ramses@well-founded.dev>
-
@jmbaur Jared Baur <jaredbaur@fastmail.com>