Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-42089

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse dismissed (not in Nixpkgs) 1 month, 1 week ago

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.

References

https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp x_refsource_CONFIRM
https://github.com/yeoman/environment/pull/753 x_refsource_MISC
https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa x_refsource_MISC

Affected products

environment

==>= 2.9.0, < 6.0.1

Matching in nixpkgs

pkgs.sbclPackages.cl-environments

None

nixos-unstable 20250622-git
- nixpkgs-unstable 20250622-git
- nixos-unstable-small 20250622-git
nixos-26.05 -
- nixos-26.05-small 20250622-git
- nixpkgs-26.05-darwin 20250622-git

pkgs.sbclPackages.introspect-environment

None

nixos-unstable 20241012-git
- nixpkgs-unstable 20241012-git
- nixos-unstable-small 20241012-git
nixos-26.05 -
- nixos-26.05-small 20241012-git
- nixpkgs-26.05-darwin 20241012-git

pkgs.akkuPackages.chibi-monad-environment

A Scheme take on the environment (reader) monad, focusing more on being efficient and convenient than pure

nixos-unstable 0.9.0
- nixpkgs-unstable 0.9.0
- nixos-unstable-small 0.9.0
nixos-26.05 -
- nixos-26.05-small 0.9.0
- nixpkgs-26.05-darwin 0.9.0

pkgs.python313Packages.environmental-override

Easily configure apps using simple environmental overrides

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-26.05 -
- nixos-26.05-small 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.python314Packages.environmental-override

Easily configure apps using simple environmental overrides

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-26.05 -
- nixos-26.05-small 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.python313Packages.pandoc-latex-environment

Pandoc filter for adding LaTeX environment on specific div

nixos-unstable 1.2.1.0
- nixpkgs-unstable 1.2.1.0
- nixos-unstable-small 1.2.1.0
nixos-26.05 -
- nixos-26.05-small 1.2.1.0
- nixpkgs-26.05-darwin 1.2.1.0

pkgs.python314Packages.pandoc-latex-environment