Nixpkgs security tracker

Login with GitHub

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Permalink CVE-2025-49974
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    3 packages
    • git-upstream
    • lomiri.qtmir
    • tests.haskell.upstreamStackHpackVersion
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through 2.1.0.

Affected products

upstream
  • =<2.1.0
Ignored packages (3)

pkgs.git-upstream

Shortcut for `git push --set-upstream`

  • nixos-unstable -
Permalink CVE-2025-53338
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    23 packages
    • replace
    • fireplace
    • qsreplace
    • replacement
    • replace-secret
    • haskellPackages.replace-attoparsec
    • haskellPackages.replace-megaparsec
    • haskellPackages.text-regex-replace
    • tests.substitute.legacySingleReplace
    • tests.replaceVars.replaceVars.succeeds
    • tests.replaceVars.replaceVarsWith.succeeds
    • tests.replaceVars.replaceVars.fails-on-directory
    • tests.replaceVars.replaceVars.fails-in-build-phase
    • tests.replaceVars.replaceVars.fails-in-check-phase
    • tests.replaceVars.replaceVarsWith.fails-on-directory
    • tests.replaceVars.replaceVars.succeeds-with-exemption
    • tests.replaceVars.replaceVarsWith.fails-in-build-phase
    • tests.replaceVars.replaceVarsWith.fails-in-check-phase
    • tests.replaceVars.replaceVarsWith.succeeds-with-exemption
    • tests.replaceVars.replaceVars.fails-in-check-phase-with-exemption
    • tests.replaceVars.replaceVars.fails-in-check-phase-with-bad-exemption
    • tests.replaceVars.replaceVarsWith.fails-in-check-phase-with-exemption
    • tests.replaceVars.replaceVarsWith.fails-in-check-phase-with-bad-exemption
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in dor re.place allows Stored XSS. This issue affects re.place: from n/a through 0.2.1.

Affected products

replace
  • =<0.2.1
Ignored packages (23)

pkgs.replace

Tool to replace verbatim strings

  • nixos-unstable -
    • nixpkgs-unstable 2.24

pkgs.qsreplace

Accept URLs on stdin, replace all query string values with a user-supplied value

  • nixos-unstable -

pkgs.replacement

Tool to execute yaml templates and output text

  • nixos-unstable -

pkgs.replace-secret

Replace a string in one file with a secret from a second file

  • nixos-unstable -
    • nixpkgs-unstable
Permalink CVE-2025-52826
8.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    4 packages
    • python312Packages.datasalad
    • python313Packages.datasalad
    • python312Packages.schema-salad
    • python313Packages.schema-salad
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

Affected products

sala
  • =<1.1.3
Ignored packages (4)

pkgs.python312Packages.datasalad

Pure-Python library with a collection of utilities for working with Git and git-annex

  • nixos-unstable -

pkgs.python313Packages.datasalad

Pure-Python library with a collection of utilities for working with Git and git-annex

  • nixos-unstable -
Permalink CVE-2025-31428
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    11 packages
    • hydrogen
    • hydroxide
    • libhydrogen
    • tau-hydrogen
    • fishPlugins.hydro
    • hydrogen-web-unwrapped
    • python312Packages.hydrogram
    • python313Packages.hydrogram
    • haskellPackages.hydrogen-version
    • python312Packages.swisshydrodata
    • python313Packages.swisshydrodata
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO allows Reflected XSS. This issue affects HYDRO: from n/a through 2.8.

Affected products

hydro
  • =<2.8
Ignored packages (11)

pkgs.hydrogen

Advanced drum machine

  • nixos-unstable -

pkgs.hydroxide

Third-party, open-source ProtonMail bridge

  • nixos-unstable -

pkgs.libhydrogen

Lightweight, secure, easy-to-use crypto library suitable for constrained environments

Permalink CVE-2025-53200
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored package gnomeExtensions.penguin-ai-chatbot 5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuantumCloud ChatBot allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ChatBot: from n/a through 6.7.3.

Affected products

chatbot
  • =<6.7.3
Ignored packages (1)

pkgs.gnomeExtensions.penguin-ai-chatbot

A GNOME Shell extension that provides a chatbot interface using various LLM providers, including Anthropic, OpenAI, Gemini, and OpenRouter. Features include multiple provider support, customizable models, chat history, customizable appearance, a keyboard shortcut, and copy-to-clipboard functionality.

  • nixos-unstable -
    • nixpkgs-unstable 22
Permalink CVE-2025-52799
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    16 packages
    • lms
    • flmsg
    • helmsman
    • lmstudio
    • python312Packages.calmsize
    • python313Packages.calmsize
    • python312Packages.dlms-cosem
    • python313Packages.dlms-cosem
    • python312Packages.llama-index-llms-ollama
    • python312Packages.llama-index-llms-openai
    • python313Packages.llama-index-llms-ollama
    • python313Packages.llama-index-llms-openai
    • python312Packages.llama-index-llms-openai-like
    • python313Packages.llama-index-llms-openai-like
    • python312Packages.llama-index-multi-modal-llms-openai
    • python313Packages.llama-index-multi-modal-llms-openai
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress LMS theme <= 9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS allows Reflected XSS. This issue affects LMS: from n/a through 9.1.

Affected products

lms
  • =<9.1
Ignored packages (16)

pkgs.lms

Lightweight Music Server - Access your self-hosted music using a web interface

  • nixos-unstable -

pkgs.flmsg

Digital modem message program

  • nixos-unstable -

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

  • nixos-unstable -

pkgs.lmstudio

LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)

  • nixos-unstable -
Permalink CVE-2025-52833
9.3 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    16 packages
    • lms
    • flmsg
    • helmsman
    • lmstudio
    • python312Packages.calmsize
    • python313Packages.calmsize
    • python312Packages.dlms-cosem
    • python313Packages.dlms-cosem
    • python312Packages.llama-index-llms-ollama
    • python312Packages.llama-index-llms-openai
    • python313Packages.llama-index-llms-ollama
    • python313Packages.llama-index-llms-openai
    • python312Packages.llama-index-llms-openai-like
    • python313Packages.llama-index-llms-openai-like
    • python312Packages.llama-index-multi-modal-llms-openai
    • python313Packages.llama-index-multi-modal-llms-openai
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress LMS <= 9.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS allows SQL Injection. This issue affects LMS: from n/a through 9.1.

Affected products

lms
  • =<9.1
Ignored packages (16)

pkgs.lms

Lightweight Music Server - Access your self-hosted music using a web interface

  • nixos-unstable -

pkgs.flmsg

Digital modem message program

  • nixos-unstable -

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

  • nixos-unstable -

pkgs.lmstudio

LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)

  • nixos-unstable -
Permalink CVE-2025-52718
7.2 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    8 packages
    • selendroid
    • stalonetray
    • art-standalone
    • argp-standalone
    • cbqn-standalone
    • htmlunit-driver
    • cbqn-standalone-replxx
    • selenium-server-standalone
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress Alone <= 7.8.2 - Arbitrary Code Execution Vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Bearsthemes Alone allows Remote Code Inclusion. This issue affects Alone: from n/a through 7.8.2.

Affected products

alone
  • =<7.8.2
Ignored packages (8)

pkgs.selendroid

Test automation for native or hybrid Android apps and the mobile web

  • nixos-unstable -

pkgs.argp-standalone

Standalone version of arguments parsing functions from Glibc

  • nixos-unstable -

pkgs.htmlunit-driver

WebDriver server for running Selenium tests on the HtmlUnit headless browser

  • nixos-unstable -
    • nixpkgs-unstable 2.27
Permalink CVE-2025-6505
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored
    45 packages
    • perlPackages.NetServer
    • perl538Packages.NetServer
    • perl540Packages.NetServer
    • perlPackages.NetLDAPServer
    • perlPackages.NetServerCoro
    • perlPackages.ServerStarter
    • perl538Packages.NetLDAPServer
    • perl538Packages.NetServerCoro
    • perl538Packages.ServerStarter
    • perl540Packages.NetLDAPServer
    • perl540Packages.NetServerCoro
    • perl540Packages.ServerStarter
    • perlPackages.HTTPServerSimple
    • perlPackages.NetLDAPServerTest
    • perlPackages.NetAsyncHTTPServer
    • perlPackages.NetServerSSPrefork
    • perlPackages.PerlLanguageServer
    • perl538Packages.HTTPServerSimple
    • perl540Packages.HTTPServerSimple
    • perl538Packages.NetLDAPServerTest
    • perl540Packages.NetLDAPServerTest
    • perlPackages.HTTPServerSimplePSGI
    • perlPackages.TestHTTPServerSimple
    • perl538Packages.NetAsyncHTTPServer
    • perl538Packages.NetServerSSPrefork
    • perl538Packages.PerlLanguageServer
    • perl540Packages.NetAsyncHTTPServer
    • perl540Packages.NetServerSSPrefork
    • perl540Packages.PerlLanguageServer
    • perlPackages.HTTPServerSimpleMason
    • perlPackages.HTTPServerSimpleAuthen
    • perl538Packages.HTTPServerSimplePSGI
    • perl538Packages.TestHTTPServerSimple
    • perl538Packages.HTTPServerSimpleAuthen
    • perl540Packages.HTTPServerSimpleMason
    • perl538Packages.HTTPServerSimpleMason
    • perlPackages.PlackTestExternalServer
    • perl540Packages.TestHTTPServerSimple
    • perl540Packages.HTTPServerSimplePSGI
    • perl540Packages.HTTPServerSimpleAuthen
    • perl538Packages.PlackTestExternalServer
    • perl540Packages.PlackTestExternalServer
    • perlPackages.CatalystXScriptServerStarman
    • perl538Packages.CatalystXScriptServerStarman
    • perl540Packages.CatalystXScriptServerStarman
    5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
Unauthorized access and impersonation can occur in versions 4.6.2.3226 and …

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access.  When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.

Affected products

Server
  • =<4.6.2.3226
Ignored packages (45)
Permalink CVE-2025-47444
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 7 months, 1 week ago
  • @LeSuisse ignored package filegive 5 months, 3 weeks ago
  • @LeSuisse dismissed 5 months, 3 weeks ago
WordPress GiveWP Plugin < 4.6.1 is vulnerable to Sensitive Data (PII) Exposure

Insertion of Sensitive Information Into Sent Data vulnerability in Liquid Web GiveWP allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a before 4.6.1.

Affected products

give
  • <4.6.1
Ignored packages (1)

pkgs.filegive

Easy p2p file sending program