Nixpkgs security tracker

Published

Permalink CVE-2026-64806

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Published

Permalink CVE-2026-64804

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Published

Permalink CVE-2026-64805

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Published

Permalink CVE-2026-64807

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-48191

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse dismissed (not in Nixpkgs) 2 months ago

Wrong Permission Handling in Document Search Article Meta Filters

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X