Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-35455
7.3 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 days, 1 hour ago
immich has Stored XSS via OCR Text in 360° Panorama Viewer

immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.

Affected products

immich
  • ==< 2.7.0

Matching in nixpkgs

pkgs.immich

Self-hosted photo and video backup solution

pkgs.immich-cli

Self-hosted photo and video backup solution (command line interface)

pkgs.immichframe

Display your photos from Immich as a digital photo frame

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small

pkgs.immich-kiosk

Lightweight slideshow for running on kiosk devices and browsers that uses Immich as a data source

pkgs.gnomeExtensions.immich-wallpaper

Sets desktop wallpaper from Immich server photos

  • nixos-unstable 9
    • nixpkgs-unstable 9
    • nixos-unstable-small 9
  • nixos-25.11 4
    • nixos-25.11-small 4
    • nixpkgs-25.11-darwin 4

Package maintainers