Nixpkgs security tracker

Login with GitHub

Suggestions search

Published
Filter by:
With package: koito

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-72591
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 15 hours ago by @LeSuisse Activity log
  • Created suggestion 20 hours ago
  • @LeSuisse accepted 15 hours ago
  • @LeSuisse published on GitHub 15 hours ago
Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

References

Affected products

Koito
  • =<0.3.2

Matching in nixpkgs

pkgs.koito

Modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL

  • nixos-unstable -
    • nixpkgs-unstable 0.3.2
    • nixos-unstable-small 0.3.2

Package maintainers