Suggestions search

All statuses

Filter by:

With package: typstPackages.dashy-todo_0_0_3

Found 3 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-46485

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

created 21 hours ago Activity log

Created suggestion 21 hours ago

Dash: Users can write to config despire permissions (OIDC tested)

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

References

https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p x_refsource_CONFIRM
https://github.com/lissy93/dashy/releases/tag/4.0.8 x_refsource_MISC

Affected products

dashy

==< 4.0.8

Matching in nixpkgs

pkgs.dashy-ui

Open source, highly customizable, easy-to-use, privacy-respecting dashboard app

nixos-unstable 4.3.3
- nixpkgs-unstable 4.3.11
- nixos-unstable-small 4.4.2
nixos-26.05 4.0.7
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.0.7

pkgs.typstPackages.dashy-todo

None

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
nixos-26.05 0.1.3
- nixpkgs-26.05-darwin 0.1.3

pkgs.typstPackages.dashy-todo_0_0_1

None

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
nixos-26.05 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.typstPackages.dashy-todo_0_0_2

None

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
nixos-26.05 0.0.2
- nixpkgs-26.05-darwin 0.0.2

pkgs.typstPackages.dashy-todo_0_0_3

None

nixos-unstable 0.0.3
- nixpkgs-unstable 0.0.3
nixos-26.05 0.0.3
- nixpkgs-26.05-darwin 0.0.3

pkgs.typstPackages.dashy-todo_0_1_0

None

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
nixos-26.05 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.typstPackages.dashy-todo_0_1_1

None

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
nixos-26.05 0.1.1
- nixpkgs-26.05-darwin 0.1.1

pkgs.typstPackages.dashy-todo_0_1_2

None

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
nixos-26.05 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.typstPackages.dashy-todo_0_1_3

None

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
nixos-26.05 0.1.3
- nixpkgs-26.05-darwin 0.1.3

Package maintainers

@TheRealGramdalf Gramdalf <gramdalftech@gmail.com>

Untriaged

Permalink CVE-2026-54443

5.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 21 hours ago Activity log

Created suggestion 21 hours ago

Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.

References

https://github.com/lissy93/dashy/security/advisories/GHSA-2x3v-qmgm-r8hv x_refsource_CONFIRMexploit
https://github.com/lissy93/dashy/releases/tag/3.2.0 x_refsource_MISC

Affected products

dashy

==>= 1.9.4, < 3.2.0

Matching in nixpkgs

pkgs.dashy-ui

Open source, highly customizable, easy-to-use, privacy-respecting dashboard app

nixos-unstable 4.3.3
- nixpkgs-unstable 4.3.11
- nixos-unstable-small 4.4.2
nixos-26.05 4.0.7
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.0.7

pkgs.typstPackages.dashy-todo

None

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
nixos-26.05 0.1.3
- nixpkgs-26.05-darwin 0.1.3

pkgs.typstPackages.dashy-todo_0_0_1

None

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
nixos-26.05 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.typstPackages.dashy-todo_0_0_2

None

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
nixos-26.05 0.0.2
- nixpkgs-26.05-darwin 0.0.2

pkgs.typstPackages.dashy-todo_0_0_3

None

nixos-unstable 0.0.3
- nixpkgs-unstable 0.0.3
nixos-26.05 0.0.3
- nixpkgs-26.05-darwin 0.0.3

pkgs.typstPackages.dashy-todo_0_1_0

None

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
nixos-26.05 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.typstPackages.dashy-todo_0_1_1

None

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
nixos-26.05 0.1.1
- nixpkgs-26.05-darwin 0.1.1

pkgs.typstPackages.dashy-todo_0_1_2

None

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
nixos-26.05 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.typstPackages.dashy-todo_0_1_3

None

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
nixos-26.05 0.1.3
- nixpkgs-26.05-darwin 0.1.3

Package maintainers

@TheRealGramdalf Gramdalf <gramdalftech@gmail.com>

Untriaged

Permalink CVE-2026-55592

3.9 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created suggestion 1 week, 2 days ago

Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.