Nixpkgs security tracker

Login with GitHub

Suggestions search

Published
Filter by:
With package: janet

Found 6 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-10267
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 5 hours ago by @LeSuisse Activity log
  • Created suggestion 9 hours ago
  • @LeSuisse ignored
    3 references
    5 hours ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    5 hours ago
  • @LeSuisse accepted 5 hours ago
  • @LeSuisse published on GitHub 5 hours ago
janet-lang janet debug.c doframe out-of-bounds

A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.

Affected products

janet
  • ==1.26
  • ==1.34
  • ==1.15
  • ==1.19
  • ==1.10
  • ==1.38
  • ==1.28
  • ==1.33
  • ==1.18
  • ==1.20
  • ==1.6
  • ==1.39
  • ==1.40
  • ==1.3
  • ==1.1
  • ==1.31
  • ==1.27
  • ==1.35
  • ==1.36
  • ==1.24
  • ==1.11
  • ==1.22
  • ==1.25
  • ==1.8
  • ==1.29
  • ==1.5
  • ==1.12
  • ==1.30
  • ==1.13
  • ==1.17
  • ==1.4
  • ==1.16
  • ==1.21
  • ==1.14
  • ==1.0
  • ==1.7
  • ==1.2
  • ==1.9
  • ==1.41.0
  • ==1.32
  • ==1.37
  • ==1.23

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Permalink CVE-2026-10268
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 5 hours ago by @LeSuisse Activity log
janet-lang janet marsh.c unmarshal_one_fiber integer overflow

A weakness has been identified in janet-lang janet up to 1.41.0. This vulnerability affects the function unmarshal_one_fiber of the file src/core/marsh.c. Executing a manipulation can lead to integer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d9b1d711ea1fde52ac73a82088b512a3e17bad0d. A patch should be applied to remediate this issue.

Affected products

janet
  • ==1.26
  • ==1.34
  • ==1.15
  • ==1.19
  • ==1.10
  • ==1.38
  • ==1.28
  • ==1.33
  • ==1.18
  • ==1.20
  • ==1.6
  • ==1.39
  • ==1.40
  • ==1.3
  • ==1.1
  • ==1.31
  • ==1.27
  • ==1.35
  • ==1.36
  • ==1.24
  • ==1.11
  • ==1.22
  • ==1.25
  • ==1.8
  • ==1.29
  • ==1.5
  • ==1.12
  • ==1.30
  • ==1.13
  • ==1.17
  • ==1.4
  • ==1.16
  • ==1.21
  • ==1.14
  • ==1.0
  • ==1.7
  • ==1.2
  • ==1.9
  • ==1.41.0
  • ==1.32
  • ==1.37
  • ==1.23

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Permalink CVE-2026-2869
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago
janet-lang janet handleattr specials.c janetc_varset out-of-bounds

A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_varset of the file src/core/specials.c of the component handleattr Handler. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 1.41.0 addresses this issue. The identifier of the patch is 2fabc80151a2b8834ee59cda8a70453f848b40e5. The affected component should be upgraded.

Affected products

janet
  • ==1.40.0
  • ==1.40.1
  • ==1.41.0

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Upstream issue: https://github.com/janet-lang/janet/issues/1699
Upstream patch: https://github.com/janet-lang/janet/commit/2fabc80151a2b8834ee59cda8a70453f848b40e5
Permalink CVE-2026-2242
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 3 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 3 weeks ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    3 months, 3 weeks ago
  • @LeSuisse accepted 3 months, 3 weeks ago
  • @LeSuisse published on GitHub 3 months, 3 weeks ago
janet-lang janet specials.c janetc_if out-of-bounds

A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.

Affected products

janet
  • ==1.40.0
  • ==1.40.1

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Upstream patch: https://github.com/janet-lang/janet/commit/c43e06672cd9dacf2122c99f362120a17c34b391
Permalink CVE-2026-2241
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 3 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 3 weeks ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    3 months, 3 weeks ago
  • @LeSuisse accepted 3 months, 3 weeks ago
  • @LeSuisse published on GitHub 3 months, 3 weeks ago
janet-lang janet os.c os_strftime out-of-bounds

A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is named 0f285855f0e34f9183956be5f16e045f54626bff. To fix this issue, it is recommended to deploy a patch.

Affected products

janet
  • ==1.40.0
  • ==1.40.1

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Upstream patch: https://github.com/janet-lang/janet/commit/0f285855f0e34f9183956be5f16e045f54626bff
Permalink CVE-2026-2240
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 3 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 3 weeks ago
  • @LeSuisse ignored
    6 packages
    • vscode-extensions.janet-lang.vscode-janet
    • tree-sitter-grammars.tree-sitter-janet-simple
    • vimPlugins.nvim-treesitter-parsers.janet_simple
    • python312Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python313Packages.tree-sitter-grammars.tree-sitter-janet-simple
    • python314Packages.tree-sitter-grammars.tree-sitter-janet-simple
    3 months, 3 weeks ago
  • @LeSuisse accepted 3 months, 3 weeks ago
  • @LeSuisse published on GitHub 3 months, 3 weeks ago
janet-lang janet compile.c janetc_pop_funcdef out-of-bounds

A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5. A patch should be applied to remediate this issue.

Affected products

janet
  • ==1.40.0
  • ==1.40.1

Matching in nixpkgs

Ignored packages (6)

Package maintainers

Upstream patch: https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5