Nixpkgs security tracker

Untriaged

Permalink CVE-2025-12506

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 week ago Activity log

Created suggestion 1 week ago

Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.

References

HackerOne Bug Bounty Report #3351460 technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/578988
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

Affected products

GitLab

<19.0.4
<19.1.2
<18.11.7

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.5
- nixos-unstable-small 18.11.6
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.6
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ee

GitLab Enterprise Edition

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.5
- nixos-unstable-small 18.11.6
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.6
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

nixos-unstable 8.89.0
- nixpkgs-unstable 8.89.0
- nixos-unstable-small 8.89.0
nixos-26.05 8.89.0
- nixos-26.05-small 8.89.0
- nixpkgs-26.05-darwin 8.89.0

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

nixos-unstable 18.6.3
- nixpkgs-unstable 18.6.3
- nixos-unstable-small 18.6.3
nixos-26.05 18.6.3
- nixos-26.05-small 18.6.3
- nixpkgs-26.05-darwin 18.6.3

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.3
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.5
- nixos-unstable-small 18.11.6
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.6
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-shell

SSH access and repository management app for GitLab

nixos-unstable 14.50.0
- nixpkgs-unstable 14.50.0
- nixos-unstable-small 14.50.0
nixos-26.05 14.50.0
- nixos-26.05-small 14.50.0
- nixpkgs-26.05-darwin 14.50.0

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

nixos-unstable 10.0.0
- nixpkgs-unstable 10.0.0
- nixos-unstable-small 10.0.0
nixos-26.05 10.0.0
- nixos-26.05-small 10.0.0
- nixpkgs-26.05-darwin 10.0.0

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

nixos-unstable 19.0.0
- nixpkgs-unstable 19.0.0
- nixos-unstable-small 19.0.0
nixos-26.05 18.11.3
- nixos-26.05-small 18.11.3
- nixpkgs-26.05-darwin 18.11.3

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

nixos-unstable 1.50.0
- nixpkgs-unstable 1.50.0
- nixos-unstable-small 1.50.0
nixos-26.05 1.50.0
- nixos-26.05-small 1.50.0
- nixpkgs-26.05-darwin 1.50.0

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

nixos-unstable 4.64.1
- nixpkgs-unstable 4.64.1
- nixos-unstable-small 4.64.1
nixos-26.05 4.64.1
- nixos-26.05-small 4.64.1
- nixpkgs-26.05-darwin 4.64.1

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

nixos-unstable 0.7.1
- nixpkgs-unstable 0.7.1
- nixos-unstable-small 0.7.1
nixos-26.05 0.7.1
- nixos-26.05-small 0.7.1
- nixpkgs-26.05-darwin 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.4.0
- nixos-26.05-small 2.4.0
- nixpkgs-26.05-darwin 2.4.0

pkgs.gitlab-workhorse

None

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.5
- nixos-unstable-small 18.11.6
nixos-26.05 18.11.6
- nixos-26.05-small 18.11.6
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

nixos-unstable 0.24.0
- nixpkgs-unstable 0.24.0
- nixos-unstable-small 0.24.0
nixos-26.05 0.24.0
- nixos-26.05-small 0.24.0
- nixpkgs-26.05-darwin 0.24.0

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-container-registry

GitLab Docker toolset to pack, ship, store, and deliver content

nixos-unstable 4.39.0
- nixpkgs-unstable 4.39.0
- nixos-unstable-small 4.39.0
nixos-26.05 4.39.0
- nixos-26.05-small 4.39.0
- nixpkgs-26.05-darwin 4.39.0

pkgs.ocamlPackages.gitlab-jsoo

Gitlab APIv4 JavaScript library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.ocamlPackages.gitlab-unix

Gitlab APIv4 Unix library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.rubyPackages.gitlab-markup

None

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0
nixos-26.05 2.0.0
- nixos-26.05-small 2.0.0
- nixpkgs-26.05-darwin 2.0.0

pkgs.terraform-providers.gitlab

None

nixos-unstable 19.0.0
- nixpkgs-unstable 19.1.0
- nixos-unstable-small 19.1.0
nixos-26.05 18.11.0
- nixos-26.05-small 18.11.0
- nixpkgs-26.05-darwin 18.11.0

pkgs.ocamlPackages_latest.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-elasticsearch-indexer

Indexes Git repositories into Elasticsearch for GitLab

nixos-unstable 5.14.7
- nixpkgs-unstable 5.14.7
- nixos-unstable-small 5.14.7
nixos-26.05 5.14.7
- nixos-26.05-small 5.14.7
- nixpkgs-26.05-darwin 5.14.7

pkgs.haskellPackages.gitlab-haskell

A Haskell library for the GitLab web API

nixos-unstable 1.1.0.0
- nixpkgs-unstable 1.1.0.0
- nixos-unstable-small 1.1.0.0
nixos-26.05 1.1.0.0
- nixos-26.05-small 1.1.0.0
- nixpkgs-26.05-darwin 1.1.0.0