Nixpkgs security tracker

Untriaged

Permalink CVE-2026-44932

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 4 weeks ago Activity log

Created suggestion 4 weeks ago

indirect remote shell command injection via unsanitized DHCP options in wicked

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

References

https://bugzilla.suse.com/show_bug.cgi?id=1265221 issue-tracking
https://github.com/openSUSE/wicked/releases/tag/version-0.6.79 release-notes
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026688.html vendor-advisory
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026689.html vendor-advisory
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026690.html vendor-advisory
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026691.html vendor-advisory

Affected products

wicked

<0.6.79

Matching in nixpkgs

pkgs.typstPackages.wicked

A flexible and easy-to-use package for typesetting Wick contractions

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0
nixos-26.05 0.2.0
- nixos-26.05-small 0.2.0
- nixpkgs-26.05-darwin 0.2.0

pkgs.typstPackages.wicked_0_1_0

A flexible and easy-to-use package for typesetting Wick contractions

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 0.1.0
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.typstPackages.wicked_0_1_1

A flexible and easy-to-use package for typesetting Wick contractions

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1
nixos-26.05 0.1.1
- nixos-26.05-small 0.1.1
- nixpkgs-26.05-darwin 0.1.1

pkgs.typstPackages.wicked_0_2_0

A flexible and easy-to-use package for typesetting Wick contractions

nixos-unstable 0.2.0
- nixpkgs-unstable 0.2.0
- nixos-unstable-small 0.2.0
nixos-26.05 0.2.0
- nixos-26.05-small 0.2.0
- nixpkgs-26.05-darwin 0.2.0

Package maintainers

@RossSmyth Ross Smyth
@cherrypiejam Gongqi Huang

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.typstPackages.wicked

pkgs.typstPackages.wicked_0_1_0

pkgs.typstPackages.wicked_0_1_1

pkgs.typstPackages.wicked_0_2_0

Package maintainers