Nixpkgs security tracker

Published

Permalink CVE-2025-14573

3.8 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
4 packages
- mattermost-desktop
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
5 months, 2 weeks ago
@LeSuisse deleted
5 maintainers
- @fsagbuya
- @Kranzes
- @numinit
- @mgdelacroix
- @ryantm
5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Team Admin Bypass of Invite Permissions via allow_open_invite Field

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

References

MMSA-2025-00561 vendor-advisory

Affected products

Mattermost

=<10.11.9
==11.3.0
==10.11.10

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.10
- nixpkgs-unstable 10.11.10
- nixos-unstable-small 10.11.10

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.4.0
- nixpkgs-unstable 11.4.0
- nixos-unstable-small 11.4.0

Ignored packages (4)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.0.4
- nixpkgs-unstable 6.0.4
- nixos-unstable-small 6.0.4

pkgs.python312Packages.mattermostdriver

None

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

Ignored maintainers (3)

@ryantm Ryan Mulligan <ryan@ryantm.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>

Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561

Published

Permalink CVE-2026-1046

7.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
4 packages
- mattermost-desktop
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
5 months, 2 weeks ago
@LeSuisse deleted
5 maintainers
- @fsagbuya
- @Kranzes
- @numinit
- @mgdelacroix
- @ryantm
5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Arbitrary application execution via unvalidated server-controlled URLs in Help menu

Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

References

MMSA-2026-00577 vendor-advisory

Affected products

Mattermost

=<5.2.13
==5.13.3.0
==6.0.3.0
==6.1.0
=<6.2.0

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.10
- nixpkgs-unstable 10.11.10
- nixos-unstable-small 10.11.10

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.4.0
- nixpkgs-unstable 11.4.0
- nixos-unstable-small 11.4.0

Ignored packages (4)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.0.4
- nixpkgs-unstable 6.0.4
- nixos-unstable-small 6.0.4

pkgs.python312Packages.mattermostdriver

None

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

Ignored maintainers (3)

@ryantm Ryan Mulligan <ryan@ryantm.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>

Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561

Published

Permalink CVE-2025-14350

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
4 packages
- mattermost-desktop
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
5 months, 2 weeks ago
@LeSuisse deleted
5 maintainers
- @fsagbuya
- @Kranzes
- @numinit
- @mgdelacroix
- @ryantm
5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Information disclosure via channel mentions in posts

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563

References

MMSA-2025-00563 vendor-advisory

Affected products

Mattermost

==10.11.10
==11.3.0
=<11.1.2
==11.1.3
=<10.11.9
=<11.2.1
==11.2.2

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.10
- nixpkgs-unstable 10.11.10
- nixos-unstable-small 10.11.10

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.4.0
- nixpkgs-unstable 11.4.0
- nixos-unstable-small 11.4.0

Ignored packages (4)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.0.4
- nixpkgs-unstable 6.0.4
- nixos-unstable-small 6.0.4

pkgs.python312Packages.mattermostdriver

None

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

Ignored maintainers (3)

@ryantm Ryan Mulligan <ryan@ryantm.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>

Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561

Published

Permalink CVE-2026-0999

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
4 packages
- mattermost-desktop
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- python314Packages.mattermostdriver
5 months, 2 weeks ago
@LeSuisse deleted
5 maintainers
- @ryantm
- @mgdelacroix
- @numinit
- @Kranzes
- @fsagbuya
5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Authentication bypass via userID login when email and username login are disabled

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548

References

MMSA-2025-00548 vendor-advisory

Affected products

Mattermost

==10.11.10
==11.3.0
=<11.1.2
==11.1.3
=<10.11.9
=<11.2.1
==11.2.2

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.10
- nixpkgs-unstable 10.11.10
- nixos-unstable-small 10.11.10

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.4.0
- nixpkgs-unstable 11.4.0
- nixos-unstable-small 11.4.0

Ignored packages (4)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 6.0.4
- nixpkgs-unstable 6.0.4
- nixos-unstable-small 6.0.4

pkgs.python312Packages.mattermostdriver

None

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python314Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

Ignored maintainers (3)

@ryantm Ryan Mulligan <ryan@ryantm.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>

Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561

Dismissed

Permalink CVE-2025-14822

3.1 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored
3 packages
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- mattermost-desktop
6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

DoS from quadratic complexity in model.ParseHashtags

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP request containing a post with thousands space-separated tokens

References

https://mattermost.com/security-updates

Affected products

Mattermost

==11.2.0
==10.11.9
=<10.11.8

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.8
- nixpkgs-unstable 10.11.7
- nixos-unstable-small 10.11.8

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.0.5
- nixpkgs-unstable 11.0.5
- nixos-unstable-small 11.0.5

Ignored packages (3)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 5.13.1
- nixpkgs-unstable 5.13.1
- nixos-unstable-small 5.13.1

pkgs.python312Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

@Kranzes Ilan Joselevich <personal@ilanjoselevich.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>
@ryantm Ryan Mulligan <ryan@ryantm.com>

Already fixed in unstable and stable branches.

Dismissed

Permalink CVE-2025-14435

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored
5 packages
- python312Packages.mattermostdriver
- python313Packages.mattermostdriver
- mattermost-desktop
- mattermostLatest
- mattermost
6 months, 2 weeks ago
@LeSuisse restored
2 packages
- mattermostLatest
- mattermost
6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

Application-Level DoS via infinite re-render loop in user profile handling

Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.

References

https://mattermost.com/security-updates

Affected products

Mattermost

==11.0.7
==11.2.0
=<10.11.8
==10.11.9
=<11.1.1
=<11.0.6
==11.1.2

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.8
- nixpkgs-unstable 10.11.7
- nixos-unstable-small 10.11.8

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 11.0.5
- nixpkgs-unstable 11.0.5
- nixos-unstable-small 11.0.5

Ignored packages (3)

pkgs.mattermost-desktop

Mattermost Desktop client

nixos-unstable 5.13.1
- nixpkgs-unstable 5.13.1
- nixos-unstable-small 5.13.1

pkgs.python312Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

pkgs.python313Packages.mattermostdriver

Python Mattermost Driver

nixos-unstable 7.3.2
- nixpkgs-unstable 7.3.2
- nixos-unstable-small 7.3.2

Package maintainers

@Kranzes Ilan Joselevich <personal@ilanjoselevich.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@mgdelacroix Miguel de la Cruz <mgdelacroix@gmail.com>
@ryantm Ryan Mulligan <ryan@ryantm.com>

Already fixed in unstable and stable branches.

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

pkgs.python314Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.mattermost

pkgs.mattermostLatest

pkgs.mattermost-desktop

pkgs.python312Packages.mattermostdriver

pkgs.python313Packages.mattermostdriver

Package maintainers