Nixpkgs security tracker
9.2 CRITICAL
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects …
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.
References
-
https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve technical-descriptionexploitthird-party-advisory
Affected products
- =<8.33.0.0
Matching in nixpkgs
pkgs.pocket-id
OIDC provider with passkeys support
pkgs.pocket-tts
Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs
pkgs.pocketbase
Open Source realtime backend in 1 file
pkgs.pocket-casts
Pocket Casts webapp, packaged for the Linux Desktop
pkgs.pocketsphinx
Small speech recognizer
pkgs.pkgsRocm.pocket-tts
Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs
pkgs.gpd-pocket-4-pipewire
Pipewire audio DSP for internal speakers of GPD Pocket 4
-
nixos-unstable 4-pipewire-0.0.1
- nixpkgs-unstable 4-pipewire-0.0.1
- nixos-unstable-small 4-pipewire-0.0.1
-
nixos-26.05 4-pipewire-0.0.1
- nixos-26.05-small 4-pipewire-0.0.1
- nixpkgs-26.05-darwin 4-pipewire-0.0.1
pkgs.python313Packages.pocket
Wrapper for the pocket API
pkgs.python314Packages.pocket
Wrapper for the pocket API
pkgs.python313Packages.pocket-tts
Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs
pkgs.python314Packages.pocket-tts
Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs
pkgs.terraform-providers.pocketid
None
pkgs.python313Packages.pocketsphinx
Small speech recognizer
pkgs.python314Packages.pocketsphinx
Small speech recognizer
pkgs.haskellPackages.gh-pocket-knife
Script helpers for interacting with GitHub
pkgs.kdePackages.kdegraphics-mobipocket
A collection of plugins to handle mobipocket files
pkgs.terraform-providers.trozz_pocketid
None
Package maintainers
-
@MarcelCoding Marcel <me@m4rc3l.de>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@K900 Ilya K. <me@0upti.me>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@yayayayaka Yaya <github@uwu.is>
-
@ymstnt ymstnt
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
-
@marcusramberg Marcus Ramberg <marcus@means.no>
-
@Eschguy Austin Eschweiler <austin.eschweiler@gmail.com>
-
@hesiod Tobias Markus <tobias@markus-regensburg.de>
-
@thilobillerbeck Thilo Billerbeck <thilo.billerbeck@officerent.de>
-
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>