Nixpkgs security tracker

Untriaged

Permalink CVE-2026-3108

8.0 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 3 weeks ago

Terminal Escape Injection in mmctl Report Posts Command

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

References

MMSA-2026-00599 vendor-advisory

Affected products

Mattermost

==11.2.3
==11.3.2
==10.11.11
=<10.11.10
=<11.4.0
=<11.3.1
==11.4.1
==11.5.0
=<11.2.2

Matching in nixpkgs

pkgs.mattermost

Mattermost is an open source platform for secure collaboration across the entire software development lifecycle

nixos-unstable 10.11.13
- nixpkgs-unstable 10.11.13
- nixos-unstable-small 10.11.13
nixos-25.11 10.11.13
- nixos-25.11-small 10.11.13
- nixpkgs-25.11-darwin 10.11.12