Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

Untriaged
Filter by:
With package: xml-tooling-c

Found 4 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-87993
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 weeks, 1 day ago Activity log
  • Created suggestion 2 weeks, 1 day ago
Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

Affected products

Tooling
  • <0.43.0

Matching in nixpkgs

pkgs.xml-tooling-c

Low-level library that provides a high level interface to XML processing for OpenSAML 2

  • nixos-unstable -
    • nixos-unstable-small 3.3.0
  • nixos-26.05 -
    • nixos-26.05-small 3.3.0

Package maintainers

Permalink CVE-2026-8715
9.6 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0.

Affected products

Tooling
  • <1.5.0

Matching in nixpkgs

pkgs.xml-tooling-c

Low-level library that provides a high level interface to XML processing for OpenSAML 2

  • nixos-unstable -
    • nixos-unstable-small 3.3.0
  • nixos-26.05 -
    • nixos-26.05-small 3.3.0

Package maintainers

Permalink CVE-2026-14361
4.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Consul-template is vulnerable to path redirection in writeToFile through symlink attack

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

Affected products

Tooling
  • <0.42.1

Matching in nixpkgs

pkgs.xml-tooling-c

Low-level library that provides a high level interface to XML processing for OpenSAML 2

  • nixos-unstable -
    • nixos-unstable-small 3.3.0
  • nixos-26.05 -
    • nixos-26.05-small 3.3.0

Package maintainers

Permalink CVE-2026-4660
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 5 months, 2 weeks ago Activity log
  • Created suggestion 5 months, 2 weeks ago
Go-getter may allow to arbitrary filesystem reads through git operations

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Affected products

Tooling
  • <1.8.6

Matching in nixpkgs

pkgs.xml-tooling-c

Low-level library that provides a high level interface to XML processing for OpenSAML 2

  • nixos-unstable -
    • nixos-unstable-small 3.3.0
  • nixos-26.05 -
    • nixos-26.05-small 3.3.0

Package maintainers