Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses

Filter by:

With package: alerta

Found 1 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-34400

created 2 weeks, 3 days ago

alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

References

https://github.com/alerta/alerta/security/advisories/GHSA-8prr-286p-4w7j x_refsource_CONFIRM
https://github.com/alerta/alerta/pull/2040 x_refsource_MISC
https://github.com/alerta/alerta/pull/712 x_refsource_MISC
https://github.com/alerta/alerta/commit/aeba85a37a09e5769a7a2da56481aa979ff99a00 x_refsource_MISC
https://github.com/alerta/alerta/commit/fdd52cd1abad8d02d1dfb8ecdcdbb43b6af3b883 x_refsource_MISC
https://github.com/alerta/alerta/releases/tag/v9.1.0 x_refsource_MISC

Affected products

alerta

==< 9.1.0

Matching in nixpkgs

pkgs.alerta

Alerta Monitoring System command-line interface

nixos-unstable 8.5.3
- nixpkgs-unstable 8.5.3
- nixos-unstable-small 8.5.3
nixos-25.11 8.5.3
- nixos-25.11-small 8.5.3
- nixpkgs-25.11-darwin 8.5.3

pkgs.alerta-server

Alerta Monitoring System server

nixos-unstable 9.0.1
- nixpkgs-unstable 9.0.1
- nixos-unstable-small 9.0.1
nixos-25.11 9.0.1
- nixos-25.11-small 9.0.1
- nixpkgs-25.11-darwin 9.0.1

pkgs.python312Packages.meteoalertapi

Python wrapper for MeteoAlarm.org

nixos-25.11 0.3.1
- nixos-25.11-small 0.3.1
- nixpkgs-25.11-darwin 0.3.1

pkgs.python313Packages.meteoalertapi

Python wrapper for MeteoAlarm.org

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-25.11 0.3.1
- nixos-25.11-small 0.3.1
- nixpkgs-25.11-darwin 0.3.1

pkgs.python314Packages.meteoalertapi

Python wrapper for MeteoAlarm.org

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>

1