Nixpkgs security tracker
8.8 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.
References
Affected products
Matching in nixpkgs
pkgs.libkrun
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.pipewire
Server and user space API to deal with multimedia pipelines
pkgs.libkrunfw
Dynamic library bundling the guest payload consumed by libkrun
pkgs.libkrun-efi
EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities
pkgs.libkrun-sev
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.libkrun-tdx
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.faust2firefox
The faust2firefox script, part of faust functional programming language for realtime audio signal processing
pkgs.firefox_decrypt
Tool to extract passwords from profiles of Mozilla Firefox and derivatives
pkgs.pkgsRocm.firefox
Web browser built from Firefox source tree
pkgs.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.asha-pipewire-sink
Sample ASHA implementation for Linux designed to work with pipewire and bluez
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2025-05-20
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2025-05-20
pkgs.firefox-gnome-theme
GNOME theme for Firefox
pkgs.firefox-sync-client
Commandline-utility to list/view/edit/delete entries in a firefox-sync account
pkgs.pkgsRocm.firefoxpwa
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.firefox-devtools-mcp
Model Context Protocol server for Firefox DevTools automation
-
nixos-unstable -
- nixos-unstable-small 0.9.9
pkgs.firefoxpwa-unwrapped
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.firefox-esr-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.3.0esr
pkgs.gpd-pocket-4-pipewire
Pipewire audio DSP for internal speakers of GPD Pocket 4
-
nixos-unstable -
- nixos-unstable-small 4-pipewire-0.0.1
-
nixos-26.05 -
- nixos-26.05-small 4-pipewire-0.0.1
pkgs.kdePackages.kpipewire
Components relating to Flatpak 'pipewire' use in Plasma.
pkgs.pkgsRocm.firefox-beta
Web browser built from Firefox Beta Release source tree
pkgs.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.pipewire-control-center
GTK4/libadwaita audio control center for PipeWire
-
nixos-unstable -
- nixos-unstable-small 0.6.0
pkgs.pkgsRocm.firefox-mobile
Web browser built from Firefox source tree
pkgs.pkgsRocm.firefox-esr-153
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
pkgs.firefox-esr-140-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 140.16.0esr
-
nixos-26.05 -
- nixos-26.05-small 140.16.0esr
pkgs.firefox-esr-153-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.3.0esr
pkgs.pkgsRocm.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.pkgsRocm.firefox-devedition
Web browser built from Firefox Developer Edition source tree
pkgs.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.pkgsRocm.firefoxpwa-unwrapped
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
-
nixos-unstable -
- nixos-unstable-small 2.19.0
pkgs.wayland-pipewire-idle-inhibit
Suspends automatic idling of Wayland compositors when media is being played through Pipewire
pkgs.pkgsRocm.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.gnomeExtensions.firefox-profiles
Easily launch Firefox with your favorite profile right from the indicator menu!
pkgs.gnomeExtensions.pipewire-settings
Top bar menu to set Pipewire's buffer size and samplerate
pkgs.pkgsRocm.firefox-esr-153-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
pkgs.pkgsRocm.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.gnomeExtensions.pipewire-airplay-toggle
Quick Setting menu toggle to enable/disable the RAOP Discover Module in PipeWire, allowing users to quickly and easily show or hide their AirPlay enabled speakers. This extension now also supports PulseAudio starting from version 8. For full details and dependency information, please review the GitHub repository wiki.
pkgs.gnomeExtensions.firefox-pip-always-on-top
Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces
pkgs.gnomeExtensions.pip-alwaysontop-for-firefox
Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.
pkgs.obs-studio-plugins.obs-pipewire-audio-capture
Audio device and application capture for OBS Studio using PipeWire
pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug
Visual Studio Code extension for debugging web applications and browser extensions in Firefox
Package maintainers
-
@onny Jonas Heinrich <onny@project-insanity.org>
-
@pmahoney Patrick Mahoney <pat@polycrystal.org>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
-
@rhendric Ryan Hendrickson
-
@philiptaron Philip Taron <philip.taron@gmail.com>
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@nekowinston winston <hey@winston.sh>
-
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-
@unode Renato Alves <alves.rjc@gmail.com>
-
@schnusch schnusch
-
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
-
@camillemndn Camille M. <camillemondon@free.fr>
-
@honnip Jung seungwoo <me@honnip.page>
-
@MarcelCoding Marcel <me@m4rc3l.de>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@K900 Ilya K. <me@0upti.me>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
-
@nrabulinski Nikodem Rabuliński <1337-nix@nrab.lol>
-
@quinneden Quinn Edenfield <quinn@qeden.dev>
-
@fxzzi Faaris Ansari <faaris.ansari@proton.me>
-
@Elinvention Elia Argentieri <elia@elinvention.ovh>
-
@qweered Aliaksandr Samatyia <grubian2@gmail.com>
-
@ArisoN-ext ArisoN <arison@duck.com>
-
@felschr Felix Schröter <dev@felschr.com>
-
@rafameou Rafael Mazzutti <rafaelmazz22@gmail.com>