Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.
Affected products
- *
Matching in nixpkgs
pkgs.nanomq
Ultra-lightweight and blazing-fast MQTT broker for IoT edge
-
nixos-unstable -
- nixpkgs-unstable 0.23.6
pkgs.nanorc
Improved Nano Syntax Highlighting Files
-
nixos-unstable -
- nixpkgs-unstable 2020-10-10
pkgs.nanomsg
Socket library that provides several common communication patterns
-
nixos-unstable -
- nixpkgs-unstable 1.1.5
pkgs.nanosvg
Simple stupid SVG parser
-
nixos-unstable -
- nixpkgs-unstable 0-unstable-2024-12-19
pkgs.nanotts
Speech synthesizer commandline utility that improves pico2wave, included with SVOX PicoTTS
-
nixos-unstable -
- nixpkgs-unstable 2021-02-22
pkgs.nanosaur
Port of Nanosaur, a 1998 Macintosh game by Pangea Software, for modern operating systems
-
nixos-unstable -
- nixpkgs-unstable 1.4.4-unstable-2024-04-06
pkgs.nanobench
Simple, fast, accurate single-header microbenchmarking functionality for C++11/14/17/20
-
nixos-unstable -
- nixpkgs-unstable 4.3.11
pkgs.nanoflann
Header only C++ library for approximate nearest neighbor search
-
nixos-unstable -
- nixpkgs-unstable 1.7.1
pkgs.nanosaur2
Port of Nanosaur2, a 2004 Macintosh game by Pangea Software, for modern operating systems
-
nixos-unstable -
- nixpkgs-unstable 2.1.0-unstable-2023-05-21
pkgs.fusee-nano
Minimalist re-implementation of the Fusée Gelée exploit
-
nixos-unstable -
- nixpkgs-unstable 2023-05-17
pkgs.nanovna-qt
PC GUI software for NanoVNA V2 series
-
nixos-unstable -
- nixpkgs-unstable 20200403
pkgs.nano-wallet
Wallet for Nano cryptocurrency
-
nixos-unstable -
- nixpkgs-unstable 25.1
pkgs.nanopbMalloc
Protocol Buffers with small code size
-
nixos-unstable -
- nixpkgs-unstable 0.4.9.1
pkgs.nanovna-saver
Tool for reading, displaying and saving data from the NanoVNA
-
nixos-unstable -
- nixpkgs-unstable 0.7.3
pkgs.ubootNanoPCT4
Boot loader for embedded systems
-
nixos-unstable -
- nixpkgs-unstable t4-rk3399_defconfig-2025.07
pkgs.ubootNanoPCT6
Boot loader for embedded systems
-
nixos-unstable -
- nixpkgs-unstable t6-rk3588_defconfig-2025.07
pkgs.nanoboyadvance
Cycle-accurate Nintendo Game Boy Advance emulator
-
nixos-unstable -
- nixpkgs-unstable 1.8.2
pkgs.akkuPackages.nanopass
Nanopass Compiler Infrastructure
-
nixos-unstable -
- nixpkgs-unstable 1.9.2
pkgs.haskellPackages.nanovg
Haskell bindings for nanovg
-
nixos-unstable -
- nixpkgs-unstable 0.8.1.0
pkgs.kdePackages.plasma-nano
A minimal Plasma shell package
-
nixos-unstable -
- nixpkgs-unstable 6.4.5
pkgs.haskellPackages.nano-erl
Small library for Erlang-style actor semantics
-
nixos-unstable -
- nixpkgs-unstable 0.1.0.1
pkgs.haskellPackages.nanospec
A lightweight implementation of a subset of Hspec's API
-
nixos-unstable -
- nixpkgs-unstable 0.2.2
pkgs.haskellPackages.nanotime
a tiny time library
-
nixos-unstable -
- nixpkgs-unstable 0.3.2
pkgs.python312Packages.nanoid
Tiny, secure, URL-friendly, unique string ID generator for Python
-
nixos-unstable -
- nixpkgs-unstable 2.0.0
pkgs.python313Packages.nanoid
Tiny, secure, URL-friendly, unique string ID generator for Python
-
nixos-unstable -
- nixpkgs-unstable 2.0.0
pkgs.python312Packages.nanobind
Tiny and efficient C++/Python bindings
-
nixos-unstable -
- nixpkgs-unstable 2.8.0
pkgs.python312Packages.nanoleaf
Module for interacting with Nanoleaf Aurora lighting
-
nixos-unstable -
- nixpkgs-unstable 0.4.1
pkgs.python312Packages.nanotime
Provides a time object that keeps time as the number of nanoseconds since the UNIX epoch
-
nixos-unstable -
- nixpkgs-unstable 0.5.2
pkgs.python313Packages.nanobind
Tiny and efficient C++/Python bindings
-
nixos-unstable -
- nixpkgs-unstable 2.8.0
pkgs.python313Packages.nanoleaf
Module for interacting with Nanoleaf Aurora lighting
-
nixos-unstable -
- nixpkgs-unstable 0.4.1
pkgs.python313Packages.nanotime
Provides a time object that keeps time as the number of nanoseconds since the UNIX epoch
-
nixos-unstable -
- nixpkgs-unstable 0.5.2
pkgs.gnomeExtensions.nano-lights
DEPRECATED! Please use the `Smart Home` extension instead.
-
nixos-unstable -
- nixpkgs-unstable 9
pkgs.python312Packages.nanoemoji
Wee tool to build color fonts
-
nixos-unstable -
- nixpkgs-unstable 0.15.8
pkgs.python313Packages.nanoemoji
Wee tool to build color fonts
-
nixos-unstable -
- nixpkgs-unstable 0.15.8
pkgs.python312Packages.pynanoleaf
Python3 wrapper for the Nanoleaf API, capable of controlling both Nanoleaf Aurora and Nanoleaf Canvas
-
nixos-unstable -
- nixpkgs-unstable 0.1.1
pkgs.python313Packages.pynanoleaf
Python3 wrapper for the Nanoleaf API, capable of controlling both Nanoleaf Aurora and Nanoleaf Canvas
-
nixos-unstable -
- nixpkgs-unstable 0.1.1
pkgs.python312Packages.aionanoleaf
Python wrapper for the Nanoleaf API
-
nixos-unstable -
- nixpkgs-unstable 0.2.1
pkgs.python312Packages.nanoeigenpy
Support library for bindings between Eigen in C++ and Python, based on nanobind
-
nixos-unstable -
- nixpkgs-unstable 0.4.0
pkgs.python313Packages.aionanoleaf
Python wrapper for the Nanoleaf API
-
nixos-unstable -
- nixpkgs-unstable 0.2.1
pkgs.python313Packages.nanoeigenpy
Support library for bindings between Eigen in C++ and Python, based on nanobind
-
nixos-unstable -
- nixpkgs-unstable 0.4.0
pkgs.python312Packages.nanomsg-python
Bindings for nanomsg
-
nixos-unstable -
- nixpkgs-unstable 1.0.20190114
pkgs.python313Packages.nanomsg-python
Bindings for nanomsg
-
nixos-unstable -
- nixpkgs-unstable 1.0.20190114
pkgs.chickenPackages_5.chickenEggs.nanomsg
None
-
nixos-unstable -
- nixpkgs-unstable 1.0.0.6
pkgs.chickenPackages_5.chickenEggs.nanosleep
Interface to POSIX nanosleep
-
nixos-unstable -
- nixpkgs-unstable 0.3.0
pkgs.home-assistant-component-tests.nanoleaf
Open source home automation that puts local control and privacy first
-
nixos-unstable -
- nixpkgs-unstable 2025.9.3
Package maintainers
-
@leo60228 leo60228 <leo@60228.dev>
-
@honnip Jung seungwoo <me@honnip.page>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@K900 Ilya K. <me@0upti.me>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@ttuegel Thomas Tuegel <ttuegel@mailbox.org>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@NeQuissimus Tim Steinbach <tim@nequissimus.com>
-
@joachifm Joachim Fasting <joachifm@fastmail.fm>
-
@SigmaSquadron Fernando Rodrigues <alpha@sigmasquadron.net>
-
@jluttine Jaakko Luttinen <jaakko.luttinen@iki.fi>
-
@mtpham99 Matthew T. Pham <pham.matthew+git@protonmail.com>
-
@TomaSajt TomaSajt
-
@bzizou Bruno Bzeznik <Bruno@bzizou.net>
-
@999eagle Sophie Tauchert <github@999eagle.moe>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@kalbasit Wael Nasreddine <wael.nasreddine@gmail.com>
-
@liarokapisv Alexandros Liarokapis <liarokapis.v@gmail.com>
-
@luxzeitlos Lux <lux@lux.name>
-
@strikerlulu StrikerLulu <strikerlulu7@gmail.com>
-
@chuangzhu Chuang Zhu <nixos@chuang.cz>
-
@hesiod Tobias Markus <tobias@markus-regensburg.de>
-
@zaninime Francesco Zanini <francesco@zanini.me>
-
@phiadaarr Philipp Arras <c@philipp-arras.de>
-
@nim65s Guilhem Saurel <guilhem.saurel@laas.fr>
-
@bgamari Ben Gamari <ben@smart-cactus.org>
-
@CMCDragonkai Roger Qiu <roger.qiu@matrix.ai>
-
@Oro Marco Orovecchia <marco@orovecchia.at>
-
@dezgeg Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
-
@lopsided98 Ben Wolsieffer <benwolsieffer@gmail.com>