Nixpkgs security tracker
5.4 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.
References
-
https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x x_refsource_CONFIRM
Affected products
- ==< 0.7.1
Matching in nixpkgs
pkgs.graylogPlugins.splunk
Graylog output plugin that forwards one or more streams of data to Splunk via TCP
-
nixos-unstable 0.5.0-rc.1
- nixpkgs-unstable 0.5.0-rc.1
- nixos-unstable-small 0.5.0-rc.1
-
nixos-25.11 0.5.0-rc.1
- nixos-25.11-small 0.5.0-rc.1
- nixpkgs-25.11-darwin 0.5.0-rc.1
pkgs.python312Packages.splunk-sdk
The Splunk Enterprise Software Development Kit (SDK) for Python
pkgs.python313Packages.splunk-sdk
The Splunk Enterprise Software Development Kit (SDK) for Python
pkgs.python314Packages.splunk-sdk
Splunk Enterprise Software Development Kit (SDK) for Python
pkgs.python312Packages.hass-splunk
Async single threaded connector to Splunk HEC using an asyncio session
pkgs.python313Packages.hass-splunk
Async single threaded connector to Splunk HEC using an asyncio session
pkgs.python314Packages.hass-splunk
Async single threaded connector to Splunk HEC using an asyncio session
pkgs.python312Packages.pysigma-backend-splunk
Library to support Splunk for pySigma
pkgs.python313Packages.pysigma-backend-splunk
Library to support Splunk for pySigma
pkgs.python314Packages.pysigma-backend-splunk
Library to support Splunk for pySigma
Package maintainers
-
@fadenb Tristan Helmich <tristan.helmich+nixos@gmail.com>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@levigross Levi Gross <levi@levigross.com>