Nixpkgs security tracker
6.1 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): High (H)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.
References
-
https://github.com/nolabs-ai/nono/security/advisories/GHSA-27vp-2mmc-vmh3 x_refsource_CONFIRM
Affected products
- ==< 0.55.0
Matching in nixpkgs
pkgs.nono
Secure, kernel-enforced sandbox for AI agents, MCP and LLM workloads
pkgs.mononoki
Font for programming and code review
pkgs.gnonograms
Nonograms puzzle game
pkgs.nerd-fonts.mononoki
Nerd Fonts: Keeps in mind differentiation of characters and resolution sizes
pkgs.maple-mono.Normal-CN
Open source Normal Ligature monospace CN font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-NF
Open source Normal Ligature Nerd Font font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-OTF
Open source Normal Ligature OpenType font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-TTF
Open source Normal Ligature monospace TrueType font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-CN
Open source Normal No Ligature monospace CN font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-NF
Open source Normal No Ligature Nerd Font font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-NF-CN
Open source Normal Ligature Nerd Font CN font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-Woff2
Open source Normal Ligature WOFF2.0 font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-OTF
Open source Normal No Ligature OpenType font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-TTF
Open source Normal No Ligature monospace TrueType font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-NF-CN
Open source Normal No Ligature Nerd Font CN font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-Woff2
Open source Normal No Ligature WOFF2.0 font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-Variable
Open source Normal Ligature monospace variable font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-Variable
Open source Normal No Ligature monospace variable font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-CN-unhinted
Open source Normal Ligature monospace CN unhinted font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-NF-unhinted
Open source Normal Ligature Nerd Font unhinted font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-TTF-AutoHint
Open source Normal Ligature monospace ttf autohint font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-CN-unhinted
Open source Normal No Ligature monospace CN unhinted font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-NF-unhinted
Open source Normal No Ligature Nerd Font unhinted font with round corner and ligatures for IDE and command line
pkgs.maple-mono.Normal-NF-CN-unhinted
Open source Normal Ligature Nerd Font CN unhinted font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-TTF-AutoHint
Open source Normal No Ligature monospace ttf autohint font with round corner and ligatures for IDE and command line
pkgs.maple-mono.NormalNL-NF-CN-unhinted
Open source Normal No Ligature Nerd Font CN unhinted font with round corner and ligatures for IDE and command line
Package maintainers
-
@fgaz Francesco Gazzetta <fgaz@fgaz.me>
-
@oluceps oluceps <nixos@oluceps.uk>
-
@rc-zb Xiao Haifan <rc-zb@outlook.com>
-
@doronbehar Doron Behar <me@doronbehar.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>