Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-53633

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 days, 11 hours ago by @LeSuisse Activity log

Created suggestion 1 week ago
@LeSuisse dismissed (not in Nixpkgs) 6 days, 11 hours ago

Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/10444 x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/10450 x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/10456 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/385a1aefd4c2bfa5e7d58bf7c6834c929969f2c7 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/63e3b2eee4d58da56786a6333f517b9b492528c7 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v4.1.8 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.4 x_refsource_MISC

Affected products

vitest

==>= 4.0.0, < 4.1.8
==>= 5.0.0-beta.0, < 5.0.0-beta.4
==>= 3.0.0, < 3.2.5

Matching in nixpkgs

pkgs.vscode-extensions.vitest.explorer

Vitest extension for Visual Studio Code

nixos-unstable 1.50.2
- nixpkgs-unstable 1.50.2
- nixos-unstable-small 1.50.2
nixos-26.05 1.50.2
- nixos-26.05-small 1.50.2
- nixpkgs-26.05-darwin 1.50.2

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-47429

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 days, 11 hours ago by @LeSuisse Activity log

Created suggestion 1 week ago
@LeSuisse dismissed (not in Nixpkgs) 6 days, 11 hours ago

Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0.

References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/10445 x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/9350 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v3.2.5 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v4.1.0 x_refsource_MISC

Affected products

vitest

==< 3.2.5
==>= 4.0.0, < 4.1.0

Matching in nixpkgs

pkgs.vscode-extensions.vitest.explorer

Vitest extension for Visual Studio Code

nixos-unstable 1.50.2
- nixpkgs-unstable 1.50.2
- nixos-unstable-small 1.50.2
nixos-26.05 1.50.2
- nixos-26.05-small 1.50.2
- nixpkgs-26.05-darwin 1.50.2

Untriaged

Permalink CVE-2026-47428

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week ago Activity log

Created suggestion 1 week ago

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in versions 4.1.6 and 5.0.0-beta.3.

References

https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp x_refsource_CONFIRM
https://github.com/vitest-dev/vitest/pull/10283 x_refsource_MISC
https://github.com/vitest-dev/vitest/pull/10285 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06 x_refsource_MISC
https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v4.1.6 x_refsource_MISC
https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3 x_refsource_MISC

Affected products

vitest

==>= 4.0.17, < 4.1.6
==>= 5.0.0-beta.0, < 5.0.0-beta.3

Matching in nixpkgs

pkgs.vscode-extensions.vitest.explorer

Vitest extension for Visual Studio Code

nixos-unstable 1.50.2
- nixpkgs-unstable 1.50.2
- nixos-unstable-small 1.50.2
nixos-26.05 1.50.2
- nixos-26.05-small 1.50.2
- nixpkgs-26.05-darwin 1.50.2

Dismissed

Permalink CVE-2026-53632

5.5 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

Created suggestion 1 month ago
@LeSuisse dismissed 1 month ago

NTLMv2 hash disclosure via UNC path handling on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

References

https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3 x_refsource_CONFIRMexploit

Affected products

vite

==>= 8.0.0, < 8.0.16
==< 6.4.3
==>= 7.0.0, < 7.3.5

vite-plus

==< 0.1.24

launch-editor

==< 2.14.1

Matching in nixpkgs

pkgs.vite

Visual Trace Explorer (ViTE), a tool to visualize execution traces

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4
nixos-26.05 1.4
- nixos-26.05-small 1.4
- nixpkgs-26.05-darwin 1.4

pkgs.vitejs

Frontend tooling for NodeJS

nixos-unstable 7.3.1
- nixpkgs-unstable 7.3.1
- nixos-unstable-small 7.3.1
nixos-26.05 7.3.1
- nixos-26.05-small 7.3.1
- nixpkgs-26.05-darwin 7.3.1

pkgs.vitess

Database clustering system for horizontal scaling of MySQL

nixos-unstable 23.0.3
- nixpkgs-unstable 23.0.3
- nixos-unstable-small 23.0.3
nixos-26.05 23.0.3
- nixos-26.05-small 23.0.3
- nixpkgs-26.05-darwin 23.0.3

pkgs.vitetris

Terminal-based Tetris clone by Victor Nilsson

nixos-unstable 0.59.1
- nixpkgs-unstable 0.59.1
- nixos-unstable-small 0.59.1
nixos-26.05 0.59.1
- nixos-26.05-small 0.59.1
- nixpkgs-26.05-darwin 0.59.1

pkgs.python313Packages.django-vite

Integration of ViteJS in a Django project

nixos-unstable 3.1.0
- nixpkgs-unstable 3.1.0
- nixos-unstable-small 3.1.0
nixos-26.05 3.1.0
- nixos-26.05-small 3.1.0
- nixpkgs-26.05-darwin 3.1.0

pkgs.python314Packages.django-vite

Integration of ViteJS in a Django project

nixos-unstable 3.1.0
- nixpkgs-unstable 3.1.0
- nixos-unstable-small 3.1.0
nixos-26.05 3.1.0
- nixos-26.05-small 3.1.0
- nixpkgs-26.05-darwin 3.1.0

pkgs.vscode-extensions.vitest.explorer

Vitest extension for Visual Studio Code

nixos-unstable 1.50.2
- nixpkgs-unstable 1.50.2
- nixos-unstable-small 1.50.2
nixos-26.05 1.50.2
- nixos-26.05-small 1.50.2
- nixpkgs-26.05-darwin 1.50.2

Package maintainers

@sephii Sylvain Fankhauser <sephi@fhtagn.top>
@siers Raitis Veinbahs <veinbahs+nixpkgs@gmail.com>

Not for us, Windows

Dismissed

Permalink CVE-2024-52011

7.5 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 3 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse dismissed 1 month, 3 weeks ago

launch-editor vulnerable to command injection via the crafted request on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

References

https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf x_refsource_CONFIRM
https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e x_refsource_MISC

Affected products

vite

==< 5.4.9

launch-editor

==< 2.9.0

Matching in nixpkgs

pkgs.vite

Visual Trace Explorer (ViTE), a tool to visualize execution traces

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.vitejs

Frontend tooling for NodeJS

nixos-unstable 7.3.1
- nixpkgs-unstable 7.3.1
- nixos-unstable-small 7.3.1

pkgs.vitess

Database clustering system for horizontal scaling of MySQL

nixos-unstable 23.0.3
- nixpkgs-unstable 23.0.3
- nixos-unstable-small 23.0.3

pkgs.vitetris

Terminal-based Tetris clone by Victor Nilsson

nixos-unstable 0.59.1
- nixpkgs-unstable 0.59.1
- nixos-unstable-small 0.59.1

pkgs.python312Packages.django-vite

None

pkgs.python313Packages.django-vite

Integration of ViteJS in a Django project

nixos-unstable 3.1.0
- nixpkgs-unstable 3.1.0
- nixos-unstable-small 3.1.0

pkgs.python314Packages.django-vite

Integration of ViteJS in a Django project

nixos-unstable 3.1.0
- nixpkgs-unstable 3.1.0
- nixos-unstable-small 3.1.0

pkgs.vscode-extensions.vitest.explorer

Vitest extension for Visual Studio Code

nixos-unstable 1.50.2
- nixpkgs-unstable 1.50.2
- nixos-unstable-small 1.50.2

Package maintainers

@sephii Sylvain Fankhauser <sephi@fhtagn.top>
@siers Raitis Veinbahs <veinbahs+nixpkgs@gmail.com>

Not for us, Windows.

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-5383

4.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 2 weeks ago
@LeSuisse dismissed (not in Nixpkgs) 3 months, 2 weeks ago

runZero Explorer missing authorization check

An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.