Nixpkgs Security Tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

to queue a suggestion for refinement.

to remove a suggestion from the queue.

CVE-2024-12224
created 6 months, 2 weeks ago
idna accepts Punycode labels that do not produce any non-ASCII when decoded

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Affected products

idna
  • <1.0.0

Matching in nixpkgs

pkgs.kodiPackages.idna

Internationalized Domain Names for Python

pkgs.python311Packages.idna

Internationalized Domain Names in Applications (IDNA)

pkgs.python312Packages.idna

Internationalized Domain Names in Applications (IDNA)

pkgs.python313Packages.idna

Internationalized Domain Names in Applications (IDNA)

pkgs.python311Packages.idna-ssl

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python312Packages.idna-ssl

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python313Packages.idna-ssl

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python312Packages.idna.x86_64-linux

Internationalized Domain Names in Applications (IDNA)

pkgs.python312Packages.idna.aarch64-linux

Internationalized Domain Names in Applications (IDNA)

pkgs.python312Packages.idna.x86_64-darwin

Internationalized Domain Names in Applications (IDNA)

pkgs.python312Packages.idna.aarch64-darwin

Internationalized Domain Names in Applications (IDNA)

pkgs.python312Packages.idna-ssl.x86_64-linux

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python312Packages.idna-ssl.aarch64-linux

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python312Packages.idna-ssl.x86_64-darwin

Patch ssl.match_hostname for Unicode(idna) domains support

pkgs.python312Packages.idna-ssl.aarch64-darwin

Patch ssl.match_hostname for Unicode(idna) domains support

Package maintainers: 17

CVE-2023-40550
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months, 2 weeks ago
Shim: out-of-bound read in verify_buffer_sbat()

An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.

Affected products

shim
  • *
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-25.05 ???
    • nixos-25.05-small 1
  • nixos-unstable 1
    • nixos-unstable-small 1
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

pkgs.rshim-user-space

user-space rshim driver for the BlueField SoC

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

pkgs.mpv-shim-default-shaders

Preconfigured set of MPV shaders and configurations for MPV Shim media clients

pkgs.python311Packages.shimmy

API conversion tool for popular external reinforcement learning environments

pkgs.python312Packages.shimmy

API conversion tool for popular external reinforcement learning environments

pkgs.libudev0-shim.x86_64-linux

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable ???
    • nixos-unstable-small 1

pkgs.shim-unsigned.x86_64-linux

UEFI shim loader

pkgs.libudev0-shim.aarch64-linux

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable ???
    • nixos-unstable-small 1

pkgs.shim-unsigned.aarch64-linux

UEFI shim loader

pkgs.rshim-user-space.x86_64-linux

user-space rshim driver for the BlueField SoC

pkgs.pantheon.elementary-print-shim

Simple shim for printing support via Contractor

pkgs.rshim-user-space.aarch64-linux

user-space rshim driver for the BlueField SoC

pkgs.python311Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python313Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.x86_64-linux

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.aarch64-linux

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.x86_64-darwin

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.aarch64-darwin

Switch frontends to Jupyter Server

pkgs.python312Packages.pytz-deprecation-shim.x86_64-linux

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.aarch64-linux

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.x86_64-darwin

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.aarch64-darwin

Shims to make deprecation of pytz easier

Package maintainers: 13

CVE-2023-40548
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 2 weeks ago
Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.

Affected products

shim
  • *
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-25.05 ???
    • nixos-25.05-small 1
  • nixos-unstable 1
    • nixos-unstable-small 1
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

pkgs.rshim-user-space

user-space rshim driver for the BlueField SoC

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

pkgs.mpv-shim-default-shaders

Preconfigured set of MPV shaders and configurations for MPV Shim media clients

pkgs.python311Packages.shimmy

API conversion tool for popular external reinforcement learning environments

pkgs.python312Packages.shimmy

API conversion tool for popular external reinforcement learning environments

pkgs.libudev0-shim.x86_64-linux

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable ???
    • nixos-unstable-small 1

pkgs.shim-unsigned.x86_64-linux

UEFI shim loader

pkgs.libudev0-shim.aarch64-linux

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable ???
    • nixos-unstable-small 1

pkgs.shim-unsigned.aarch64-linux

UEFI shim loader

pkgs.rshim-user-space.x86_64-linux

user-space rshim driver for the BlueField SoC

pkgs.pantheon.elementary-print-shim

Simple shim for printing support via Contractor

pkgs.rshim-user-space.aarch64-linux

user-space rshim driver for the BlueField SoC

pkgs.python311Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python313Packages.notebook-shim

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.x86_64-linux

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.aarch64-linux

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.x86_64-darwin

Switch frontends to Jupyter Server

pkgs.python312Packages.notebook-shim.aarch64-darwin

Switch frontends to Jupyter Server

pkgs.python312Packages.pytz-deprecation-shim.x86_64-linux

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.aarch64-linux

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.x86_64-darwin

Shims to make deprecation of pytz easier

pkgs.python312Packages.pytz-deprecation-shim.aarch64-darwin

Shims to make deprecation of pytz easier

Package maintainers: 13

CVE-2025-1461
5.6 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 2 weeks ago
Vuetify XSS through 'eventMoreText' prop of VCalendar

Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a  Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation. This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Affected products

vuetify
  • ==>=2.0.0 <3.0.0

Matching in nixpkgs

pkgs.python311Packages.ipyvuetify

Jupyter widgets based on Vuetify UI Components

pkgs.python312Packages.ipyvuetify

Jupyter widgets based on Vuetify UI Components

pkgs.python313Packages.ipyvuetify

Jupyter widgets based on Vuetify UI Components

pkgs.python312Packages.ipyvuetify.x86_64-linux

Jupyter widgets based on Vuetify UI Components

pkgs.python312Packages.ipyvuetify.aarch64-linux

Jupyter widgets based on Vuetify UI Components

pkgs.python312Packages.ipyvuetify.x86_64-darwin

Jupyter widgets based on Vuetify UI Components

pkgs.python312Packages.ipyvuetify.aarch64-darwin

Jupyter widgets based on Vuetify UI Components

Package maintainers: 1

CVE-2025-0716
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 2 weeks ago
AngularJS improper sanitization in SVG '<image>' element

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected products

angular
  • ==>=0.0.0

Matching in nixpkgs

pkgs.angular-language-server

LSP for angular completions, AOT diagnostic, quick info and go to definitions

pkgs.vimPlugins.nvim-treesitter-parsers.angular

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

Package maintainers: 1

CVE-2024-8372
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 2 weeks ago
AngularJS improper sanitization in 'srcset' attribute

Improper sanitization of the value of the '[srcset]' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected products

angular
  • ==>=1.3.0-rc.4

Matching in nixpkgs

pkgs.angular-language-server

LSP for angular completions, AOT diagnostic, quick info and go to definitions

pkgs.vimPlugins.nvim-treesitter-parsers.angular

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

Package maintainers: 1

CVE-2024-8373
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 2 weeks ago
AngularJS improper sanitization in '<source>' element

Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected products

angular
  • ==>=0.0.0

Matching in nixpkgs

pkgs.angular-language-server

LSP for angular completions, AOT diagnostic, quick info and go to definitions

pkgs.vimPlugins.nvim-treesitter-parsers.angular

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

Package maintainers: 1

CVE-2025-5278
4.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months, 3 weeks ago
Coreutils: heap buffer under-read in gnu coreutils sort via key specification

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Affected products

rhcos
coreutils
  • <9.8

Matching in nixpkgs

pkgs.coreutils

GNU Core Utilities

pkgs.coreutils-full

GNU Core Utilities

pkgs.policycoreutils

SELinux policy core utilities

pkgs.uutils-coreutils

Cross-platform Rust rewrite of the GNU coreutils

pkgs.coreutils-prefixed

GNU Core Utilities

pkgs.uutils-coreutils-noprefix

Cross-platform Rust rewrite of the GNU coreutils

Package maintainers: 4

CVE-2025-48798
7.3 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 3 weeks ago
Gimp: multiple use after free in xcf parser

A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.

Affected products

gimp
  • *
  • <3.0.0
gimp:2.8
  • *
gimp:2.8/gimp

Matching in nixpkgs

pkgs.zigimports

Automatically remove unused imports and globals from Zig files

pkgs.gimpPlugins.bimp

Batch Image Manipulation Plugin for GIMP

pkgs.gimpPlugins.gmic

GIMP plugin for the G'MIC image processing framework

pkgs.gimp3Plugins.gimp

GNU Image Manipulation Program

pkgs.gimp3Plugins.gmic

GIMP plugin for the G'MIC image processing framework

pkgs.gimp3-with-plugins

GNU Image Manipulation Program

pkgs.gimpPlugins.fourier

GIMP plug-in to do the fourier transform

pkgs.gimpPlugins.lightning

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

pkgs.gimp3Plugins.lightning

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

Package maintainers: 3

CVE-2025-48796
7.3 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 3 weeks ago
Gimp: stack-based buffer overflows in file-ico

A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be used to store more information than the capacity allows. This flaw allows a malicious ANI file to trigger arbitrary code execution.

Affected products

gimp
  • <2.99.16
gimp:2.8/gimp

Matching in nixpkgs

pkgs.zigimports

Automatically remove unused imports and globals from Zig files

pkgs.gimpPlugins.bimp

Batch Image Manipulation Plugin for GIMP

pkgs.gimpPlugins.gmic

GIMP plugin for the G'MIC image processing framework

pkgs.gimp3Plugins.gimp

GNU Image Manipulation Program

pkgs.gimp3Plugins.gmic

GIMP plugin for the G'MIC image processing framework

pkgs.gimp3-with-plugins

GNU Image Manipulation Program

pkgs.gimpPlugins.fourier

GIMP plug-in to do the fourier transform

pkgs.gimpPlugins.lightning

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

pkgs.gimp3Plugins.lightning

  • nixos-25.05 ???
    • nixos-25.05-small
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

Package maintainers: 3