Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-7182

9.2 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 3 days ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse dismissed (not in Nixpkgs) 1 week, 3 days ago

Path Traversal in Diagram

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

References

https://cert.pl/en/posts/2026/05/CVE-2026-7182 third-party-advisory
https://docs.dhtmlx.com/diagram/whats_new/#version-612 release-notes
https://dhtmlx.com/docs/products/dhtmlxDiagram/ product

Affected products

Diagram

<1.1.1

Matching in nixpkgs

pkgs.diagrams-as-code

Declarative configurations using YAML for drawing cloud system architectures

nixos-unstable 0.0.4
- nixpkgs-unstable 0.0.4
- nixos-unstable-small 0.0.4
nixos-25.11 0.0.4
- nixos-25.11-small 0.0.4
- nixpkgs-25.11-darwin 0.0.4

pkgs.diagrams-builder

hint-based build service for the diagrams graphics EDSL

nixos-unstable 0.8.0.6
- nixpkgs-unstable 0.8.0.6
- nixos-unstable-small 0.8.0.6
nixos-25.11 0.8.0.6
- nixos-25.11-small 0.8.0.6
- nixpkgs-25.11-darwin 0.8.0.6

pkgs.pandoc-ext-diagram

Generate diagrams from embedded code; supports Mermaid, Dot/GraphViz, PlantUML, Asymptote, D2, CeTZ, and TikZ

nixos-unstable 1.2.0
- nixpkgs-unstable 1.2.0
- nixos-unstable-small 1.2.0
nixos-25.11 1.2.0
- nixos-25.11-small 1.2.0
- nixpkgs-25.11-darwin 1.2.0

pkgs.libsForQt5.kdiagram

Libraries for creating business diagrams

nixos-25.11 2.8.0
- nixos-25.11-small 2.8.0
- nixpkgs-25.11-darwin 2.8.0

pkgs.kdePackages.kdiagram

Powerful libraries (KChart, KGantt) for creating business diagrams

nixos-unstable 3.0.1
- nixpkgs-unstable 3.0.1
- nixos-unstable-small 3.0.1
nixos-25.11 3.0.1
- nixos-25.11-small 3.0.1
- nixpkgs-25.11-darwin 3.0.1

pkgs.typstPackages.modiagram

Draw molecular orbital and energy pathway diagrams

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.diagrams

Embedded domain-specific language for declarative vector graphics

nixos-unstable 1.4.2
- nixpkgs-unstable 1.4.2
- nixos-unstable-small 1.4.2
nixos-25.11 1.4.2
- nixos-25.11-small 1.4.2
- nixpkgs-25.11-darwin 1.4.2

pkgs.plasma5Packages.kdiagram

Libraries for creating business diagrams

nixos-25.11 2.8.0
- nixos-25.11-small 2.8.0
- nixpkgs-25.11-darwin 2.8.0

pkgs.python312Packages.diagrams

Diagram as Code

nixos-25.11 0.24.4
- nixos-25.11-small 0.24.4
- nixpkgs-25.11-darwin 0.24.4

pkgs.python313Packages.diagrams

Diagram as Code

nixos-unstable 0.25.1
- nixpkgs-unstable 0.25.1
- nixos-unstable-small 0.25.1
nixos-25.11 0.24.4
- nixos-25.11-small 0.24.4
- nixpkgs-25.11-darwin 0.24.4

pkgs.python314Packages.diagrams

Diagram as Code

nixos-unstable 0.25.1
- nixpkgs-unstable 0.25.1
- nixos-unstable-small 0.25.1

pkgs.haskellPackages.diagrams-gtk

Backend for rendering diagrams directly to GTK windows

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4
nixos-25.11 1.4
- nixos-25.11-small 1.4
- nixpkgs-25.11-darwin 1.4

pkgs.haskellPackages.diagrams-lib

Embedded domain-specific language for declarative graphics

nixos-unstable 1.5.1
- nixpkgs-unstable 1.5.1
- nixos-unstable-small 1.5.1
nixos-25.11 1.5.0.1
- nixos-25.11-small 1.5.0.1
- nixpkgs-25.11-darwin 1.5.0.1

pkgs.haskellPackages.diagrams-pgf

PGF backend for diagrams drawing EDSL

nixos-unstable 1.5.0.1
- nixpkgs-unstable 1.5.0.1
- nixos-unstable-small 1.5.0.1
nixos-25.11 1.5.0.1
- nixos-25.11-small 1.5.0.1
- nixpkgs-25.11-darwin 1.5.0.1

pkgs.haskellPackages.diagrams-svg

SVG backend for diagrams drawing EDSL

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-25.11 1.5
- nixos-25.11-small 1.5
- nixpkgs-25.11-darwin 1.5

pkgs.haskellPackages.diagrams-core

Core libraries for diagrams EDSL

nixos-unstable 1.5.1.1
- nixpkgs-unstable 1.5.1.1
- nixos-unstable-small 1.5.1.1
nixos-25.11 1.5.1.1
- nixos-25.11-small 1.5.1.1
- nixpkgs-25.11-darwin 1.5.1.1

pkgs.python312Packages.osc-diagram

Build Outscale cloud diagrams

nixos-25.11 2023-08-07
- nixos-25.11-small 2023-08-07
- nixpkgs-25.11-darwin 2023-08-07

pkgs.python313Packages.osc-diagram

Build Outscale cloud diagrams

nixos-unstable 2023-08-07
- nixpkgs-unstable 2023-08-07
- nixos-unstable-small 2023-08-07
nixos-25.11 2023-08-07
- nixos-25.11-small 2023-08-07
- nixpkgs-25.11-darwin 2023-08-07

pkgs.python314Packages.osc-diagram

Build Outscale cloud diagrams

nixos-unstable 2023-08-07
- nixpkgs-unstable 2023-08-07
- nixos-unstable-small 2023-08-07

pkgs.typstPackages.modiagram_0_1_0

Draw molecular orbital and energy pathway diagrams

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0

pkgs.typstPackages.modiagram_0_1_1

Draw molecular orbital and energy pathway diagrams

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.Chart-diagrams

Diagrams backend for Charts

nixos-unstable 1.9.5.1
- nixpkgs-unstable 1.9.5.1
- nixos-unstable-small 1.9.5.1
nixos-25.11 1.9.5.1
- nixos-25.11-small 1.9.5.1
- nixpkgs-25.11-darwin 1.9.5.1

pkgs.haskellPackages.diagrams-cairo

Cairo backend for diagrams drawing EDSL

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-25.11 1.5
- nixos-25.11-small 1.5
- nixpkgs-25.11-darwin 1.5

pkgs.haskellPackages.diagrams-input

Parse raster and SVG files for diagrams

nixos-unstable 0.1.5
- nixpkgs-unstable 0.1.5
- nixos-unstable-small 0.1.5
nixos-25.11 0.1.5
- nixos-25.11-small 0.1.5
- nixpkgs-25.11-darwin 0.1.5

pkgs.haskellPackages.diagrams-solve

Pure Haskell solver routines used by diagrams

nixos-unstable 0.1.3.1
- nixpkgs-unstable 0.1.3.1
- nixos-unstable-small 0.1.3.1
nixos-25.11 0.1.3.1
- nixos-25.11-small 0.1.3.1
- nixpkgs-25.11-darwin 0.1.3.1

pkgs.haskellPackages.diagrams-canvas

HTML5 canvas backend for diagrams drawing EDSL

nixos-unstable 1.4.2
- nixpkgs-unstable 1.4.2
- nixos-unstable-small 1.4.2
nixos-25.11 1.4.2
- nixos-25.11-small 1.4.2
- nixpkgs-25.11-darwin 1.4.2

pkgs.haskellPackages.diagrams-pandoc

A Pandoc filter to express diagrams inline using the Haskell EDSL _Diagrams_

nixos-unstable 0.4.1
- nixpkgs-unstable 0.4.1
- nixos-unstable-small 0.4.1
nixos-25.11 0.4.1
- nixos-25.11-small 0.4.1
- nixpkgs-25.11-darwin 0.4.1

pkgs.haskellPackages.hakyll-diagrams

A Hakyll plugin for rendering diagrams figures from embedded Haskell code

nixos-unstable 0.1.0.2
- nixpkgs-unstable 0.1.0.2
- nixos-unstable-small 0.1.0.2

pkgs.haskellPackages.diagrams-braille

Braille diagrams with plain text

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-25.11 0.1.2
- nixos-25.11-small 0.1.2
- nixpkgs-25.11-darwin 0.1.2

pkgs.haskellPackages.diagrams-builder

hint-based build service for the diagrams graphics EDSL

nixos-unstable 0.8.0.6
- nixpkgs-unstable 0.8.0.6
- nixos-unstable-small 0.8.0.6
nixos-25.11 0.8.0.6
- nixos-25.11-small 0.8.0.6
- nixpkgs-25.11-darwin 0.8.0.6

pkgs.haskellPackages.diagrams-contrib

Collection of user contributions to diagrams EDSL

nixos-unstable 1.4.6
- nixpkgs-unstable 1.4.6
- nixos-unstable-small 1.4.6
nixos-25.11 1.4.6
- nixos-25.11-small 1.4.6
- nixpkgs-25.11-darwin 1.4.6

pkgs.haskellPackages.diagrams-gi-cairo

Cairo backend for diagrams drawing EDSL

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-25.11 1.5
- nixos-25.11-small 1.5
- nixpkgs-25.11-darwin 1.5

pkgs.haskellPackages.diagrams-graphviz

Graph layout and drawing with GraphViz and diagrams

nixos-unstable 1.4.1.1
- nixpkgs-unstable 1.4.1.1
- nixos-unstable-small 1.4.1.1
nixos-25.11 1.4.1.1
- nixos-25.11-small 1.4.1.1
- nixpkgs-25.11-darwin 1.4.1.1

pkgs.haskellPackages.ihaskell-diagrams

IHaskell display instances for diagram types

nixos-unstable 0.4.0.0
- nixpkgs-unstable 0.4.0.0
- nixos-unstable-small 0.4.0.0
nixos-25.11 0.4.0.0
- nixos-25.11-small 0.4.0.0
- nixpkgs-25.11-darwin 0.4.0.0

pkgs.haskellPackages.diagrams-postscript

Postscript backend for diagrams drawing EDSL

nixos-unstable 1.5.3
- nixpkgs-unstable 1.5.3
- nixos-unstable-small 1.5.3
nixos-25.11 1.5.3
- nixos-25.11-small 1.5.3
- nixpkgs-25.11-darwin 1.5.3

pkgs.haskellPackages.diagrams-rasterific

Rasterific backend for diagrams

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-25.11 1.5
- nixos-25.11-small 1.5
- nixpkgs-25.11-darwin 1.5

pkgs.python312Packages.railroad-diagrams

Module to generate SVG railroad syntax diagrams

nixos-25.11 3.0.1
- nixos-25.11-small 3.0.1
- nixpkgs-25.11-darwin 3.0.1

pkgs.python313Packages.railroad-diagrams

Module to generate SVG railroad syntax diagrams

nixos-unstable 3.0.1
- nixpkgs-unstable 3.0.1
- nixos-unstable-small 3.0.1
nixos-25.11 3.0.1
- nixos-25.11-small 3.0.1
- nixpkgs-25.11-darwin 3.0.1

pkgs.python314Packages.railroad-diagrams

Module to generate SVG railroad syntax diagrams

nixos-unstable 3.0.1
- nixpkgs-unstable 3.0.1
- nixos-unstable-small 3.0.1

pkgs.haskellPackages.aivika-experiment-diagrams

Diagrams-based charting backend for the Aivika simulation library

nixos-unstable 5.4.1
- nixpkgs-unstable 5.4.1
- nixos-unstable-small 5.4.1
nixos-25.11 5.4.1
- nixos-25.11-small 5.4.1
- nixpkgs-25.11-darwin 5.4.1

Package maintainers

@Sigmanificient Yohann Boniface <sigmanificient@gmail.com>
@sternenseemann Lukas Epple <sternenseemann@systemli.org>
@mjm Matt Moriarity <matt@mattmoriarity.com>
@K900 Ilya K. <me@0upti.me>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@FRidh Frederik Rietdijk <fridh@fridh.nl>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@ttuegel Thomas Tuegel <ttuegel@mailbox.org>
@bkchr Bastian Köcher <nixos@kchr.de>
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
@NickCao Nick Cao <nickcao@nichi.co>
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
@addict3d Nick Bathum <nickbathum@gmail.com>
@nicolas-goudry Nicolas Goudry <goudry.nicolas@gmail.com>
@RossSmyth Ross Smyth
@cherrypiejam Gongqi Huang

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.diagrams-as-code

pkgs.diagrams-builder

pkgs.pandoc-ext-diagram

pkgs.libsForQt5.kdiagram

pkgs.kdePackages.kdiagram

pkgs.typstPackages.modiagram

pkgs.haskellPackages.diagrams

pkgs.plasma5Packages.kdiagram

pkgs.python312Packages.diagrams

pkgs.python313Packages.diagrams

pkgs.python314Packages.diagrams

pkgs.haskellPackages.diagrams-gtk

pkgs.haskellPackages.diagrams-lib

pkgs.haskellPackages.diagrams-pgf

pkgs.haskellPackages.diagrams-svg

pkgs.haskellPackages.diagrams-core

pkgs.python312Packages.osc-diagram

pkgs.python313Packages.osc-diagram

pkgs.python314Packages.osc-diagram

pkgs.typstPackages.modiagram_0_1_0

pkgs.typstPackages.modiagram_0_1_1

pkgs.haskellPackages.Chart-diagrams

pkgs.haskellPackages.diagrams-cairo

pkgs.haskellPackages.diagrams-input

pkgs.haskellPackages.diagrams-solve

pkgs.haskellPackages.diagrams-canvas

pkgs.haskellPackages.diagrams-pandoc

pkgs.haskellPackages.hakyll-diagrams

pkgs.haskellPackages.diagrams-braille

pkgs.haskellPackages.diagrams-builder

pkgs.haskellPackages.diagrams-contrib

pkgs.haskellPackages.diagrams-gi-cairo

pkgs.haskellPackages.diagrams-graphviz

pkgs.haskellPackages.ihaskell-diagrams

pkgs.haskellPackages.diagrams-postscript

pkgs.haskellPackages.diagrams-rasterific

pkgs.python312Packages.railroad-diagrams

pkgs.python313Packages.railroad-diagrams

pkgs.python314Packages.railroad-diagrams

pkgs.haskellPackages.aivika-experiment-diagrams

Package maintainers