Nixpkgs security tracker

Permalink CVE-2025-15324

6.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored package engage 5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Tanium addressed a local privilege escalation vulnerability in Engage.

Tanium addressed a documentation issue in Engage.

References

TAN-2025-004

Affected products

Engage

<1.3.37
<1.6.193

Ignored packages (1)

pkgs.engage

Task runner with DAG-based parallelism

nixos-unstable 0.2.1
- nixpkgs-unstable 0.2.1
- nixos-unstable-small 0.2.1

Not present in nixpkgs

Permalink CVE-2020-37140

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored
4 packages
- everest
- neverest
- everest-bin
- everest-mons
5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Everest 5.50.2100 - 'Open File' Denial of Service

Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste it into the file open dialog to trigger an application crash.

References

ExploitDB-48259 exploit
Archived Product Page vendor-advisory
VulnCheck Advisory: Everest 5.50.2100 - 'Open File' Denial of Service third-party-advisory

Affected products

Everest

==5.50.2100

Ignored packages (4)

pkgs.everest

Celeste mod loader (don't install; use celestegame instead)

nixos-unstable 6157
- nixpkgs-unstable 6157
- nixos-unstable-small 6157

pkgs.neverest

CLI to synchronize, backup and restore emails

nixos-unstable 1.0.0-beta
- nixpkgs-unstable 1.0.0-beta
- nixos-unstable-small 1.0.0-beta

pkgs.everest-bin

Celeste mod loader (don't install; use celestegame instead)

nixos-unstable 6157
- nixpkgs-unstable 6157
- nixos-unstable-small 6157

pkgs.everest-mons

Commandline Everest installer and mod manager for Celeste

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0

Not present in nixpkgs also known as AIDA64

Permalink CVE-2025-15341

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored
17 packages
- gbenchmark
- mqtt-benchmark
- memtier-benchmark
- rubyPackages.benchmark
- ocamlPackages.benchmark
- rubyPackages_3_1.benchmark
- rubyPackages_3_2.benchmark
- rubyPackages_3_3.benchmark
- rubyPackages_3_4.benchmark
- rubyPackages_4_0.benchmark
- ocamlPackages_latest.benchmark
- haskellPackages.benchmark-function
- python312Packages.pytest-benchmark
- python313Packages.pytest-benchmark
- python314Packages.pytest-benchmark
- haskellPackages.hashtable-benchmark
- chickenPackages_5.chickenEggs.micro-benchmark
5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Tanium addressed an incorrect default permissions vulnerability in Benchmark.

References

TAN-2025-029

Affected products

Benchmark

<2.12.82
<2.9.188
<2.7.98

Ignored packages (17)

pkgs.gbenchmark

Microbenchmark support library

nixos-unstable 1.9.4
- nixpkgs-unstable 1.9.4
- nixos-unstable-small 1.9.4

pkgs.mqtt-benchmark

MQTT broker benchmarking tool

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0

pkgs.memtier-benchmark

Redis and Memcached traffic generation and benchmarking tool

nixos-unstable 2.2.0
- nixpkgs-unstable 2.2.0
- nixos-unstable-small 2.2.0

pkgs.rubyPackages.benchmark

None

nixos-unstable 0.5.0

pkgs.ocamlPackages.benchmark

Benchmark running times of code

nixos-unstable 1.7
- nixpkgs-unstable 1.7
- nixos-unstable-small 1.7

pkgs.rubyPackages_3_1.benchmark

None

pkgs.rubyPackages_3_2.benchmark

None

pkgs.rubyPackages_3_3.benchmark

None

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0

pkgs.rubyPackages_3_4.benchmark

None

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0

pkgs.rubyPackages_4_0.benchmark

None

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0

pkgs.ocamlPackages_latest.benchmark

Benchmark running times of code

nixos-unstable 1.7
- nixpkgs-unstable 1.7
- nixos-unstable-small 1.7

pkgs.haskellPackages.benchmark-function

Test the time it takes to run a haskell function

nixos-unstable 0.1.0.1
- nixpkgs-unstable 0.1.0.1
- nixos-unstable-small 0.1.0.1

pkgs.python312Packages.pytest-benchmark

None

pkgs.python313Packages.pytest-benchmark

Pytest fixture for benchmarking code

nixos-unstable 5.2.3
- nixpkgs-unstable 5.2.3
- nixos-unstable-small 5.2.3

pkgs.python314Packages.pytest-benchmark

Pytest fixture for benchmarking code

nixos-unstable 5.2.3
- nixpkgs-unstable 5.2.3
- nixos-unstable-small 5.2.3

pkgs.haskellPackages.hashtable-benchmark

Benchmark of hash table implementations

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.chickenPackages_5.chickenEggs.micro-benchmark

Easily create micro-benchmarks

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0

Not present in nixpkgs

Permalink CVE-2025-15343

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored
5 packages
- haskellPackages.wai-enforce-https
- python312Packages.lm-format-enforcer
- python313Packages.lm-format-enforcer
- python314Packages.lm-format-enforcer
- vimPlugins.nvim-treesitter-parsers.enforce
5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Tanium addressed an incorrect default permissions vulnerability in Enforce.

References

TAN-2025-032

Affected products

Enforce

<2.9.574
<2.7.367
<2.8.601

Ignored packages (5)

pkgs.haskellPackages.wai-enforce-https

Enforce HTTPS in Wai server app safely

nixos-unstable 1.0.0.0
- nixpkgs-unstable 1.0.0.0
- nixos-unstable-small 1.0.0.0

pkgs.python312Packages.lm-format-enforcer

None

pkgs.python313Packages.lm-format-enforcer

Enforce the output format (JSON Schema, Regex etc) of a language model

nixos-unstable 0.11.3
- nixpkgs-unstable 0.11.3
- nixos-unstable-small 0.11.3

pkgs.python314Packages.lm-format-enforcer

Enforce the output format (JSON Schema, Regex etc) of a language model

nixos-unstable 0.11.3
- nixpkgs-unstable 0.11.3
- nixos-unstable-small 0.11.3

pkgs.vimPlugins.nvim-treesitter-parsers.enforce

Tree-sitter grammar for enforce

nixos-unstable 0.0.0+rev=eb27968
- nixpkgs-unstable 0.0.0+rev=eb27968
- nixos-unstable-small 0.0.0+rev=eb27968

Not present in nixpkgs

Permalink CVE-2025-15336

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored
15 packages
- portfolio
- passmark-performancetest
- rubyPackages.rubocop-performance
- rubyPackages.standard-performance
- libretro.bsnes-mercury-performance
- rubyPackages_3_1.rubocop-performance
- rubyPackages_3_2.rubocop-performance
- rubyPackages_3_3.rubocop-performance
- rubyPackages_3_4.rubocop-performance
- rubyPackages_4_0.rubocop-performance
- rubyPackages_3_1.standard-performance
- rubyPackages_3_2.standard-performance
- rubyPackages_3_3.standard-performance
- rubyPackages_3_4.standard-performance
- rubyPackages_4_0.standard-performance
5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Tanium addressed an incorrect default permissions vulnerability in Performance.

References

TAN-2025-029

Affected products

Performance

<1.22.288
<1.17.134
<1.21.141

Ignored packages (15)

pkgs.portfolio

Simple tool to calculate the overall performance of an investment portfolio

nixos-unstable 0.81.3
- nixpkgs-unstable 0.81.3
- nixos-unstable-small 0.81.3

pkgs.passmark-performancetest

Software tool that allows everybody to quickly assess the performance of their computer and compare it to a number of standard 'baseline' computer systems

nixos-unstable 11.0.1002
- nixpkgs-unstable 11.0.1002
- nixos-unstable-small 11.0.1002

pkgs.rubyPackages.rubocop-performance

None

nixos-unstable 1.25.0

pkgs.rubyPackages.standard-performance

None

nixos-unstable 1.8.0

pkgs.libretro.bsnes-mercury-performance

Fork of bsnes with HLE DSP emulation restored (performance profile)

nixos-unstable 0-unstable-2024-10-21
- nixpkgs-unstable 0-unstable-2024-10-21
- nixos-unstable-small 0-unstable-2024-10-21

pkgs.rubyPackages_3_1.rubocop-performance

None

pkgs.rubyPackages_3_2.rubocop-performance

None

pkgs.rubyPackages_3_3.rubocop-performance

None

nixos-unstable 1.25.0
- nixpkgs-unstable 1.25.0
- nixos-unstable-small 1.25.0

pkgs.rubyPackages_3_4.rubocop-performance

None

nixos-unstable 1.25.0
- nixpkgs-unstable 1.25.0
- nixos-unstable-small 1.25.0

pkgs.rubyPackages_4_0.rubocop-performance

None

nixos-unstable 1.25.0
- nixpkgs-unstable 1.25.0
- nixos-unstable-small 1.25.0

pkgs.rubyPackages_3_1.standard-performance

None

pkgs.rubyPackages_3_2.standard-performance

None

pkgs.rubyPackages_3_3.standard-performance

None

nixos-unstable 1.8.0
- nixpkgs-unstable 1.8.0
- nixos-unstable-small 1.8.0

pkgs.rubyPackages_3_4.standard-performance

None

nixos-unstable 1.8.0
- nixpkgs-unstable 1.8.0
- nixos-unstable-small 1.8.0

pkgs.rubyPackages_4_0.standard-performance

None

nixos-unstable 1.8.0
- nixpkgs-unstable 1.8.0
- nixos-unstable-small 1.8.0

Not present in nixpkgs

Permalink CVE-2025-15340

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 5 months, 4 weeks ago
@jopejoe1 ignored
3 packages
- python314Packages.complycube
- python313Packages.complycube
- python312Packages.complycube
5 months, 4 weeks ago
@jopejoe1 dismissed 5 months, 4 weeks ago

Tanium addressed an incorrect default permissions vulnerability in Comply.

References

TAN-2025-029

Affected products

Comply

<2.24.159
<2.29.124
<2.32.155

Ignored packages (3)

pkgs.python312Packages.complycube

None

pkgs.python313Packages.complycube

Official Python client for the ComplyCube API

nixos-unstable 1.1.6
- nixpkgs-unstable 1.1.6
- nixos-unstable-small 1.1.6

pkgs.python314Packages.complycube

Official Python client for the ComplyCube API

nixos-unstable 1.1.6
- nixpkgs-unstable 1.1.6
- nixos-unstable-small 1.1.6

Not present in nixpkgs

Permalink CVE-2024-56156

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
14 packages
- eschalot
- python312Packages.halo
- python313Packages.halo
- python314Packages.halo
- typstPackages.whalogen
- python312Packages.halohome
- python313Packages.halohome
- python314Packages.halohome
- typstPackages.whalogen_0_1_0
- typstPackages.whalogen_0_2_0
- typstPackages.whalogen_0_3_0
- python312Packages.django-cachalot
- python313Packages.django-cachalot
- python314Packages.django-cachalot
5 months, 4 weeks ago
@LeSuisse dismissed 5 months, 4 weeks ago

Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.

References

https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9 x_refsource_CONFIRM
https://github.com/halo-dev/halo/pull/7149 x_refsource_MISC
https://github.com/halo-dev/halo/commit/24f8d7b57127e2607ec05adb7c912b3decddeb99 x_refsource_MISC

Affected products

halo

==< 2.20.13

Matching in nixpkgs

pkgs.halo

Self-hosted dynamic blogging program

nixos-unstable 2.22.11
- nixpkgs-unstable 2.22.11
- nixos-unstable-small 2.22.11

Ignored packages (14)

pkgs.eschalot

Tor hidden service name generator

nixos-unstable 1.2.0.20191006
- nixpkgs-unstable 1.2.0.20191006
- nixos-unstable-small 1.2.0.20191006

pkgs.python312Packages.halo

None

pkgs.python313Packages.halo

Beautiful Spinners for Terminal, IPython and Jupyter

nixos-unstable 0.0.31
- nixpkgs-unstable 0.0.31
- nixos-unstable-small 0.0.31

pkgs.python314Packages.halo

Beautiful Spinners for Terminal, IPython and Jupyter

nixos-unstable 0.0.31
- nixpkgs-unstable 0.0.31
- nixos-unstable-small 0.0.31

pkgs.typstPackages.whalogen

None

pkgs.python312Packages.halohome

None

pkgs.python313Packages.halohome

Python library to control Eaton HALO Home Smart Lights

nixos-unstable 0.7.0
- nixpkgs-unstable 0.7.0
- nixos-unstable-small 0.7.0

pkgs.python314Packages.halohome

Python library to control Eaton HALO Home Smart Lights

nixos-unstable 0.7.0
- nixpkgs-unstable 0.7.0
- nixos-unstable-small 0.7.0

pkgs.typstPackages.whalogen_0_1_0

Typesetting chemical formulae, a port of mhchem

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0

pkgs.typstPackages.whalogen_0_2_0

Typesetting chemical formulae, a port of mhchem

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0

pkgs.typstPackages.whalogen_0_3_0

Typesetting chemical formulae, a port of mhchem

nixos-unstable 0.3.0
- nixpkgs-unstable 0.3.0
- nixos-unstable-small 0.3.0

pkgs.python312Packages.django-cachalot

None

pkgs.python313Packages.django-cachalot

No effort, no worry, maximum performance

nixos-unstable 2.8.0
- nixpkgs-unstable 2.8.0
- nixos-unstable-small 2.8.0

pkgs.python314Packages.django-cachalot

No effort, no worry, maximum performance

nixos-unstable 2.8.0
- nixpkgs-unstable 2.8.0
- nixos-unstable-small 2.8.0

Package maintainers

@wangxiaoerYah Yah <yah@singularpoint.cc>

Current stable branch was never impacted.

https://github.com/NixOS/nixpkgs/pull/370594
https://github.com/NixOS/nixpkgs/pull/371151

Permalink CVE-2026-25815

3.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
4 packages
- terraform-providers.fortios
- python312Packages.fortiosapi
- python313Packages.fortiosapi
- python314Packages.fortiosapi
5 months, 4 weeks ago
@LeSuisse dismissed 5 months, 4 weeks ago

Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials …

Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.

References

Affected products

FortiOS

=<7.6.6

Ignored packages (4)

pkgs.terraform-providers.fortios

None

nixos-unstable 1.24.1
- nixpkgs-unstable 1.24.1
- nixos-unstable-small 1.24.1

pkgs.python312Packages.fortiosapi

None

pkgs.python313Packages.fortiosapi

Python module to work with Fortigate/Fortios devices

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5

pkgs.python314Packages.fortiosapi

Python module to work with Fortigate/Fortios devices

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5

Not present in nixpkgs

Permalink CVE-2022-50931

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 4 weeks ago by @Scrumplex Activity log

Created suggestion 6 months ago
@Scrumplex dismissed 5 months, 4 weeks ago

TeamSpeak 3.5.6 - Insecure File Permissions

TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers can replace system executables like ts3client_win32.exe with custom files to potentially gain SYSTEM or Administrator-level access.

References

ExploitDB-50743 exploit
TeamSpeak Official Vendor Homepage product
TeamSpeak Downloads Page product
VulnCheck Advisory: TeamSpeak 3.5.6 - Insecure File Permissions third-party-advisory

Affected products

TeamSpeak

==3.5.6

Matching in nixpkgs

pkgs.teamspeak3

TeamSpeak voice communication tool

nixos-unstable 3.6.2
- nixpkgs-unstable 3.6.2
- nixos-unstable-small 3.6.2

pkgs.teamspeak_server

TeamSpeak voice communication server

nixos-unstable 3.13.7
- nixpkgs-unstable 3.13.7
- nixos-unstable-small 3.13.7

pkgs.teamspeak6-client

TeamSpeak voice communication tool (beta version)

nixos-unstable 6.0.0-beta3.2
- nixpkgs-unstable 6.0.0-beta3.4
- nixos-unstable-small 6.0.0-beta3.4

Package maintainers

@nathanielbaxter Nathaniel Baxter <nathaniel.baxter@gmail.com>
@lukegb Luke Granger-Brown <nix@lukegb.com>
@Atemu Atemu <nixpkgs@mail.atemu.net>
@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>
@drafolin Dråfølin <derg@drafolin.ch>
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@Shados Alexei Robyn <shados@shados.net>
@Gerschtli Tobias Happ <tobias.happ@gmx.de>

All channels are patched.

Permalink CVE-2026-25137

9.1 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 4 weeks ago by @Scrumplex Activity log

Created suggestion 6 months ago
@Scrumplex dismissed 5 months, 4 weeks ago

NixOs Odoo database and filestore publicly accessible with default odoo configuration

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.