Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses
Filter by:
With package: perlPackages.AlienBuildPluginDownloadGitLab

Found 41 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-18433
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

Affected products

GitLab
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-8667
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

Affected products

GitLab
  • <19.2.2
  • <19.0.6
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-16627
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

Affected products

GitLab
  • <19.2.2

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-7427
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-15423
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-6821
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-15216
8.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-19228
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

Affected products

GitLab
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-4879
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2025-9486
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

References

Affected products

GitLab
  • <19.0.6
  • <19.2.2
  • <19.1.4

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixpkgs-unstable 0.6.0
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers