Nixpkgs security tracker

Permalink CVE-2026-75025

4.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 4 days, 5 hours ago by @LeSuisse Activity log

Created suggestion 5 days, 11 hours ago
@LeSuisse ignored
4 packages
- mattermost
- mattermostLatest
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
4 days, 5 hours ago
@LeSuisse accepted 4 days, 5 hours ago
@LeSuisse published on GitHub 4 days, 5 hours ago

Mattermost Desktop local network access from server-rendered content

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698

References

MMSA-2026-00698 vendor-advisory

Affected products

Mattermost

=<6.2.2
==6.2.3.0
==6.3.0

Matching in nixpkgs

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.1.2
- nixpkgs-unstable 6.1.2
- nixos-unstable-small 6.3.0
nixos-26.05 6.1.2
- nixos-26.05-small 6.2.2
- nixpkgs-26.05-darwin 6.1.2

Ignored packages (4)

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.7.4
- nixpkgs-unstable 11.7.4
- nixos-unstable-small 11.7.8
nixos-26.05 11.7.4
- nixos-26.05-small 11.7.8
- nixpkgs-26.05-darwin 11.7.4

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.8.1
- nixpkgs-unstable 11.8.1
- nixos-unstable-small 11.8.3
nixos-26.05 11.8.1
- nixos-26.05-small 11.8.3
- nixpkgs-26.05-darwin 11.8.1

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

Package maintainers

@jokogr Ioannis Koutras <ioannis.koutras@gmail.com>
@liff Olli Helenius <liff@iki.fi>
@yayayayaka Yaya <github@uwu.is>

Permalink CVE-2026-75588

2.6 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 days, 5 hours ago by @LeSuisse Activity log

Created suggestion 4 days, 11 hours ago
@LeSuisse ignored
4 packages
- mattermost
- mattermostLatest
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
4 days, 5 hours ago
@LeSuisse accepted 4 days, 5 hours ago
@LeSuisse published on GitHub 4 days, 5 hours ago

Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717

References

MMSA-2026-00717 vendor-advisory

Affected products

Mattermost

=<6.2.2
==6.2.3.0
==6.3.0

Matching in nixpkgs

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.1.2
- nixpkgs-unstable 6.1.2
- nixos-unstable-small 6.3.0
nixos-26.05 6.1.2
- nixos-26.05-small 6.2.2
- nixpkgs-26.05-darwin 6.1.2

Ignored packages (4)

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.7.4
- nixpkgs-unstable 11.7.4
- nixos-unstable-small 11.7.8
nixos-26.05 11.7.4
- nixos-26.05-small 11.7.8
- nixpkgs-26.05-darwin 11.7.4

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.8.1
- nixpkgs-unstable 11.8.1
- nixos-unstable-small 11.8.3
nixos-26.05 11.8.1
- nixos-26.05-small 11.8.3
- nixpkgs-26.05-darwin 11.8.1

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

Package maintainers

@liff Olli Helenius <liff@iki.fi>
@yayayayaka Yaya <github@uwu.is>
@jokogr Ioannis Koutras <ioannis.koutras@gmail.com>

Permalink CVE-2026-12284

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 4 days, 5 hours ago by @LeSuisse Activity log

Created suggestion 4 days, 11 hours ago
@LeSuisse ignored
4 packages
- mattermostLatest
- mattermost
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
4 days, 6 hours ago
@LeSuisse accepted 4 days, 6 hours ago
@LeSuisse published on GitHub 4 days, 5 hours ago

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699

References

MMSA-2026-00699 vendor-advisory

Affected products

Mattermost

=<6.2.2
==6.2.3.0
==6.3.0

Matching in nixpkgs

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.1.2
- nixpkgs-unstable 6.1.2
- nixos-unstable-small 6.3.0
nixos-26.05 6.1.2
- nixos-26.05-small 6.2.2
- nixpkgs-26.05-darwin 6.1.2

Ignored packages (4)

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.7.4
- nixpkgs-unstable 11.7.4
- nixos-unstable-small 11.7.8
nixos-26.05 11.7.4
- nixos-26.05-small 11.7.8
- nixpkgs-26.05-darwin 11.7.4

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.8.1
- nixpkgs-unstable 11.8.1
- nixos-unstable-small 11.8.3
nixos-26.05 11.8.1
- nixos-26.05-small 11.8.3
- nixpkgs-26.05-darwin 11.8.1

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2
nixos-26.05 7.3.2
- nixos-26.05-small 7.3.2
- nixpkgs-26.05-darwin 7.3.2

Package maintainers

@liff Olli Helenius <liff@iki.fi>
@yayayayaka Yaya <github@uwu.is>
@jokogr Ioannis Koutras <ioannis.koutras@gmail.com>

Permalink CVE-2026-1628

4.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored
5 packages
- mattermost
- mattermostLatest
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
6 months, 2 weeks ago
@LeSuisse deleted
2 maintainers
- @liff
- @jokogr
6 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which allows a malicious server to expose preload script functionality to untrusted servers via having a user open an external link in their Mattermost server. Mattermost Advisory ID: MMSA-2026-00596

References

MMSA-2026-00596 vendor-advisory

Affected products

Mattermost

=<5.13.3
==5.13.4.0

Matching in nixpkgs

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.0.4
- nixpkgs-unstable 6.0.4
- nixos-unstable-small 6.0.4

Ignored packages (5)

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.12
- nixpkgs-unstable 10.11.12
- nixos-unstable-small 10.11.12

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.4.0
- nixpkgs-unstable 11.4.0
- nixos-unstable-small 11.4.0

pkgs.python312Packages.mattermostdriver

None

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

Ignored maintainers (2)

@jokogr Ioannis Koutras <ioannis.koutras@gmail.com>
@liff Olli Helenius <liff@iki.fi>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.mattermost-desktop

pkgs.mattermost

pkgs.mattermostLatest

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost-desktop

pkgs.mattermost

pkgs.mattermostLatest

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost-desktop

pkgs.mattermost

pkgs.mattermostLatest

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost-desktop

pkgs.mattermost

pkgs.mattermostLatest

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers