Nixpkgs security tracker
4.2 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Caddy: stripHTML template function bypass
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.
References
-
https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v x_refsource_CONFIRM
Affected products
- ==< 2.11.4
Matching in nixpkgs
pkgs.caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
pkgs.xcaddy
Build Caddy with plugins
pkgs.caddyfile-language-server
Basic language server for caddyfile
pkgs.vimPlugins.nvim-treesitter-parsers.caddy
Tree-sitter grammar for caddy
-
nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
-
nixos-26.05 0.0.0+rev=2686186
- nixos-26.05-small 0.0.0+rev=2686186
- nixpkgs-26.05-darwin 0.0.0+rev=2686186
pkgs.tree-sitter-grammars.tree-sitter-caddyfile
Tree-sitter grammar for caddyfile
-
nixos-unstable 0-unstable-2026-04-06
- nixpkgs-unstable 0-unstable-2026-04-06
- nixos-unstable-small 0-unstable-2026-04-06
-
nixos-26.05 0-unstable-2026-04-06
- nixos-26.05-small 0-unstable-2026-04-06
- nixpkgs-26.05-darwin 0-unstable-2026-04-06
pkgs.vscode-extensions.matthewpi.caddyfile-support
Rich Caddyfile support for Visual Studio Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
Package maintainers
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
-
@matthewpi Matthew Penner <me+nix@matthewp.io>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>