Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: fermyon-spin

Found 2 matching suggestions

View:
Compact
Detailed
Dismissed
(not in Nixpkgs)
Permalink CVE-2025-58707
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 3 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 2 weeks ago
  • @LeSuisse dismissed (not in Nixpkgs) 3 months, 2 weeks ago
WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.

Affected products

Spin
  • =<1.8

Matching in nixpkgs

pkgs.spin

Formal verification tool for distributed software systems

pkgs.fermyon-spin

Framework for building, deploying, and running fast, secure, and composable cloud microservices with WebAssembly

Package maintainers

Published
Permalink CVE-2026-27887
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse ignored
    25 packages
    • spin
    • aspino
    • upspin
    • openspin
    • tailspin
    • python314Packages.click-spinner
    • python313Packages.click-spinner
    • python312Packages.click-spinner
    • python314Packages.aiosendspin
    • python313Packages.aiosendspin
    • python314Packages.spinners
    • python313Packages.spinners
    • python312Packages.spinners
    • haskellPackages.spine
    • sbclPackages.spinneret
    • haskellPackages.Spintax
    • python312Packages.yaspin
    • python313Packages.yaspin
    • python314Packages.yaspin
    • python312Packages.outspin
    • python313Packages.outspin
    • python314Packages.outspin
    • python312Packages.pyspinel
    • python313Packages.pyspinel
    • python314Packages.pyspinel
    6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago
Spin has memory leaks in various WIT interfaces

Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to allow connections to a database or web server which could return responses of unbounded size (e.g. tables with many rows or large content bodies), Spin may in some cases attempt to buffer the entire response before delivering it to the guest, which can lead to the host process running out of memory, panicking, and crashing. In addition, a malicious guest application could incrementally insert a large number of rows or values into a database and then retrieve them all in a single query, leading to large host allocations. Spin 3.6.1, SpinKube 0.6.2, and `containerd-shim-spin` 0.22.1 have been patched to address the issue. As a workaround, configure Spin to only allow access to trusted databases and HTTP servers which limit response sizes.

Affected products

spin
  • ==< 3.6.1
SpinKube
  • ==< 0.6.2
containerd-shim-spin
  • ==< 0.22.1

Matching in nixpkgs

pkgs.fermyon-spin

Framework for building, deploying, and running fast, secure, and composable cloud microservices with WebAssembly

Ignored packages (25)

pkgs.spin

Formal verification tool for distributed software systems

Upstream advisory: https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx