Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-25496
created 2 months, 1 week ago Activity log
  • Created suggestion 2 months, 1 week ago
Craft has a stored XSS in Number Prefix & Suffix Fields

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.

Affected products

cms
  • ==>= 4.0.0-RC1, < 4.16.18
  • ==>= 5.0.0-RC1, < 5.8.22

Matching in nixpkgs

pkgs.lcms1

Color management engine

  • nixos-unstable 1.19
    • nixpkgs-unstable 1.19
    • nixos-unstable-small 1.19
  • nixos-25.11 1.19
    • nixpkgs-25.11-darwin 1.19

pkgs.lcms2

Color management engine

  • nixos-unstable 2.17
    • nixpkgs-unstable 2.17
    • nixos-unstable-small 2.17
  • nixos-25.11 2.17
    • nixpkgs-25.11-darwin 2.17

pkgs.xcmsdb

Device Color Characterization utility for X Color Management System

pkgs.argyllcms

Color management system (compatible with ICC)

pkgs.pcmsolver

API for the Polarizable Continuum Model

Package maintainers