Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-32275

created 2 weeks, 5 days ago

Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.

References

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-95mg-wpqw-9qxh x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 x_refsource_MISC

Affected products

Tautulli

==>= 1.3.10, < 2.17.0

Matching in nixpkgs

pkgs.tautulli

Python based monitoring and tracking tool for Plex Media Server

nixos-unstable 2.16.1
- nixpkgs-unstable 2.16.1
- nixos-unstable-small 2.17.0
nixos-25.11 2.16.0
- nixos-25.11-small 2.16.0
- nixpkgs-25.11-darwin 2.16.0

pkgs.python312Packages.pytautulli

Python module to get information from Tautulli

nixos-25.11 23.1.1
- nixos-25.11-small 23.1.1
- nixpkgs-25.11-darwin 23.1.1

pkgs.python313Packages.pytautulli

Python module to get information from Tautulli

nixos-unstable 23.1.1
- nixpkgs-unstable 23.1.1
- nixos-unstable-small 23.1.1
nixos-25.11 23.1.1
- nixos-25.11-small 23.1.1
- nixpkgs-25.11-darwin 23.1.1

pkgs.python314Packages.pytautulli

Python module to get information from Tautulli

nixos-unstable 23.1.1
- nixpkgs-unstable 23.1.1
- nixos-unstable-small 23.1.1

pkgs.home-assistant-component-tests.tautulli

Open source home automation that puts local control and privacy first

nixos-25.11 2025.11.3
- nixos-25.11-small 2025.11.3
- nixpkgs-25.11-darwin 2025.11.3

pkgs.tests.home-assistant-component-tests.tautulli

Open source home automation that puts local control and privacy first

nixos-unstable 2026.3.4
- nixpkgs-unstable 2026.3.4
- nixos-unstable-small 2026.3.4

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@rhoriguchi Ryan Horiguchi <ryan.horiguchi@gmail.com>