Nixpkgs security tracker

Untriaged

Permalink CVE-2026-77360

6.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 5 days, 16 hours ago Activity log

Created suggestion 5 days, 16 hours ago

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

References

https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f x_refsource_CONFIRM
https://github.com/middleapi/orpc/issues/1661 exploitx_refsource_MISC
https://github.com/middleapi/orpc/pull/1662 x_refsource_MISC
https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f x_refsource_MISC
https://github.com/middleapi/orpc/releases/tag/v1.14.8 x_refsource_MISC

Affected products

orpc

==< 1.14.8

Matching in nixpkgs

pkgs.protorpc

Google Protocol Protobufs RPC for Go

nixos-unstable -
- nixos-unstable-small 1.1.2
nixos-26.05 -
- nixos-26.05-small 1.1.2

pkgs.haskellPackages.utxorpc

Generated code for a gRPC interface for UTxO Blockchains

nixos-unstable -
- nixos-unstable-small 0.0.18.1
nixos-26.05 -
- nixos-26.05-small 0.0.18.1

pkgs.python313Packages.aiorpcx

Transport, protocol and framing-independent async RPC client and server implementation

nixos-unstable -
- nixos-unstable-small 0.25.0
nixos-26.05 -
- nixos-26.05-small 0.25.0

pkgs.python314Packages.aiorpcx

Transport, protocol and framing-independent async RPC client and server implementation

nixos-unstable -
- nixos-unstable-small 0.25.0
nixos-26.05 -
- nixos-26.05-small 0.25.0

Package maintainers

@TomaSajt TomaSajt
@prusnak Pavol Rusnak <pavol@rusnak.io>

Untriaged

Permalink CVE-2026-33331

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 5 months, 4 weeks ago Activity log

Created suggestion 5 months, 4 weeks ago

oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.