Nixpkgs security tracker

Untriaged

Permalink CVE-2026-16627

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 2 weeks, 3 days ago Activity log

Created suggestion 2 weeks, 3 days ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/606678
HackerOne Bug Bounty Report #3880796 technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/

Affected products

GitLab

<19.2.2

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ee

GitLab Enterprise Edition

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

nixos-unstable 0.5.0
- nixpkgs-unstable 0.5.0
- nixos-unstable-small 0.5.0
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

nixos-unstable 8.89.0
- nixpkgs-unstable 8.89.0
- nixos-unstable-small 9.6.0
nixos-26.05 8.89.0
- nixos-26.05-small 8.89.0
- nixpkgs-26.05-darwin 8.89.0

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

nixos-unstable 18.6.3
- nixpkgs-unstable 18.6.3
- nixos-unstable-small 18.6.3
nixos-26.05 18.6.3
- nixos-26.05-small 18.6.3
- nixpkgs-26.05-darwin 18.6.3

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.4
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-shell

SSH access and repository management app for GitLab

nixos-unstable 14.50.0
- nixpkgs-unstable 14.50.0
- nixos-unstable-small 14.51.0
nixos-26.05 14.50.0
- nixos-26.05-small 14.51.0
- nixpkgs-26.05-darwin 14.50.0

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

nixos-unstable 10.0.0
- nixpkgs-unstable 10.0.0
- nixos-unstable-small 10.0.0
nixos-26.05 10.0.0
- nixos-26.05-small 10.0.0
- nixpkgs-26.05-darwin 10.0.0

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

nixos-unstable 19.0.0
- nixpkgs-unstable 19.0.0
- nixos-unstable-small 19.1.1
nixos-26.05 18.11.3
- nixos-26.05-small 18.11.3
- nixpkgs-26.05-darwin 18.11.3

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

nixos-unstable 1.50.0
- nixpkgs-unstable 1.51.0
- nixos-unstable-small 1.51.0
nixos-26.05 1.50.0
- nixos-26.05-small 1.51.0
- nixpkgs-26.05-darwin 1.50.0

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

nixos-unstable 4.64.1
- nixpkgs-unstable 4.64.1
- nixos-unstable-small 4.74.0
nixos-26.05 4.64.1
- nixos-26.05-small 4.64.1
- nixpkgs-26.05-darwin 4.64.1

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

nixos-unstable 0.7.1
- nixpkgs-unstable 0.7.1
- nixos-unstable-small 0.7.1
nixos-26.05 0.7.1
- nixos-26.05-small 0.7.1
- nixpkgs-26.05-darwin 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.4.0
- nixos-26.05-small 2.4.0
- nixpkgs-26.05-darwin 2.4.0

pkgs.gitlab-workhorse

None

nixos-unstable 18.11.5
- nixpkgs-unstable 18.11.6
- nixos-unstable-small 19.0.4
nixos-26.05 18.11.6
- nixos-26.05-small 19.0.4
- nixpkgs-26.05-darwin 18.11.6

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

nixos-unstable -
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

nixos-unstable 0.24.0
- nixpkgs-unstable 0.24.0
- nixos-unstable-small 0.24.0
nixos-26.05 0.24.0
- nixos-26.05-small 0.24.0
- nixpkgs-26.05-darwin 0.24.0

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-container-registry

GitLab Docker toolset to pack, ship, store, and deliver content

nixos-unstable 4.39.0
- nixpkgs-unstable 4.39.0
- nixos-unstable-small 4.40.2
nixos-26.05 4.39.0
- nixos-26.05-small 4.40.2
- nixpkgs-26.05-darwin 4.39.0

pkgs.ocamlPackages.gitlab-jsoo

Gitlab APIv4 JavaScript library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.ocamlPackages.gitlab-unix

Gitlab APIv4 Unix library

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.rubyPackages.gitlab-markup

None

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0
nixos-26.05 2.0.0
- nixos-26.05-small 2.0.0
- nixpkgs-26.05-darwin 2.0.0

pkgs.terraform-providers.gitlab

None

nixos-unstable 19.0.0
- nixpkgs-unstable 19.1.0
nixos-26.05 18.11.0
- nixos-26.05-small 18.11.0
- nixpkgs-26.05-darwin 18.11.0

pkgs.ocamlPackages_latest.gitlab

Native OCaml bindings to Gitlab REST API v4

nixos-unstable 0.1.8
- nixpkgs-unstable 0.1.8
- nixos-unstable-small 0.1.8
nixos-26.05 0.1.8
- nixos-26.05-small 0.1.8
- nixpkgs-26.05-darwin 0.1.8

pkgs.gitlab-elasticsearch-indexer

Indexes Git repositories into Elasticsearch for GitLab

nixos-unstable 5.14.7
- nixpkgs-unstable 5.14.7
- nixos-unstable-small 5.14.7
nixos-26.05 5.14.7
- nixos-26.05-small 5.14.7
- nixpkgs-26.05-darwin 5.14.7

pkgs.haskellPackages.gitlab-haskell

A Haskell library for the GitLab web API

nixos-unstable 1.1.0.0
- nixpkgs-unstable 1.1.0.0
- nixos-unstable-small 1.1.0.0
nixos-26.05 1.1.0.0
- nixos-26.05-small 1.1.0.0
- nixpkgs-26.05-darwin 1.1.0.0