Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: lychee

Found 3 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-33738
updated 1 month ago by @LeSuisse Activity log
  • Created suggestion 1 month ago
  • @LeSuisse ignored
    4 packages
    • LycheeSlicer
    • lycheeslicer
    • tests.testers.lycheeLinkCheck.ok
    • tests.testers.lycheeLinkCheck.network
    1 month ago
  • @LeSuisse accepted 1 month ago
  • @LeSuisse published on GitHub 1 month ago
Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.

Affected products

Lychee
  • ==< 7.5.3

Matching in nixpkgs

pkgs.lychee

Fast, async, stream-based link checker written in Rust

Ignored packages (4)

pkgs.lycheeslicer

All-in-one 3D slicer for resin and FDM printers

Package maintainers

Upstream advisory: https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j
Upstream patch: https://github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5c
Untriaged
Permalink CVE-2026-33644
created 1 month ago Activity log
  • Created suggestion 1 month ago
Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs

Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, `filter_var($host, FILTER_VALIDATE_IP)` returns `false`, skipping the entire check. Version 7.5.2 patches the issue.

Affected products

Lychee
  • ==< 7.5.2

Matching in nixpkgs

pkgs.lychee

Fast, async, stream-based link checker written in Rust

pkgs.lycheeslicer

All-in-one 3D slicer for resin and FDM printers

Package maintainers

Untriaged
Permalink CVE-2026-33537
created 1 month ago Activity log
  • Created suggestion 1 month ago
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validation check that fails to block loopback addresses and link-local addresses. Prior to version 7.5.1, an authenticated user can still reach internal services using direct IP addresses, bypassing all four protection configuration settings even when they are set to their secure defaults. Version 7.5.1 contains a fix for the issue.

Affected products

Lychee
  • ==< 7.5.1

Matching in nixpkgs

pkgs.lychee

Fast, async, stream-based link checker written in Rust

pkgs.lycheeslicer

All-in-one 3D slicer for resin and FDM printers

Package maintainers