Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-55592

3.9 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created suggestion 1 week, 2 days ago

Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

References

https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc x_refsource_CONFIRM
https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b x_refsource_MISC
https://github.com/lissy93/dashy/releases/tag/4.3.7 x_refsource_MISC

Affected products

dashy

==< 4.3.7

Matching in nixpkgs

pkgs.dashy-ui

Open source, highly customizable, easy-to-use, privacy-respecting dashboard app

nixos-unstable 4.3.3
- nixpkgs-unstable 4.3.3
- nixos-unstable-small 4.3.3
nixos-26.05 4.0.7
- nixos-26.05-small 4.0.7
- nixpkgs-26.05-darwin 4.0.7

pkgs.typstPackages.dashy-todo

A method to display TODOs at the side of the page

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
- nixos-unstable-small 0.1.3
nixos-26.05 0.1.3
- nixos-26.05-small 0.1.3
- nixpkgs-26.05-darwin 0.1.3

pkgs.typstPackages.dashy-todo_0_0_1

A method to display TODOs at the side of the page

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.typstPackages.dashy-todo_0_0_2

A method to display TODOs at the side of the page

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2
nixos-26.05 0.0.2
- nixos-26.05-small 0.0.2
- nixpkgs-26.05-darwin 0.0.2

pkgs.typstPackages.dashy-todo_0_0_3

A method to display TODOs at the side of the page

nixos-unstable 0.0.3
- nixpkgs-unstable 0.0.3
- nixos-unstable-small 0.0.3
nixos-26.05 0.0.3
- nixos-26.05-small 0.0.3
- nixpkgs-26.05-darwin 0.0.3

pkgs.typstPackages.dashy-todo_0_1_0

A method to display TODOs at the side of the page

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 0.1.0
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.typstPackages.dashy-todo_0_1_1

A method to display TODOs at the side of the page

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1
nixos-26.05 0.1.1
- nixos-26.05-small 0.1.1
- nixpkgs-26.05-darwin 0.1.1

pkgs.typstPackages.dashy-todo_0_1_2

A method to display TODOs at the side of the page

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-26.05 0.1.2
- nixos-26.05-small 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.typstPackages.dashy-todo_0_1_3

A method to display TODOs at the side of the page

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
- nixos-unstable-small 0.1.3
nixos-26.05 0.1.3
- nixos-26.05-small 0.1.3
- nixpkgs-26.05-darwin 0.1.3

Package maintainers

@TheRealGramdalf Gramdalf <gramdalftech@gmail.com>
@cherrypiejam Gongqi Huang
@RossSmyth Ross Smyth