nixpkgs vulnerabilities
4 known vulnerabilities in nixpkgs from NixOS. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.5 High severity
nixpkgs: Incorrect Default Permissions
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unpr
- 9.1 Critical severity
nixpkgs: Missing Authentication for Critical Functionality
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire
- 8.7 High severity
nixpkgs: Insertion of Sensitive Information into Externally-Accessible File or Directory
Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full
- 8.8 High severity
nixpkgs: Creation of Temporary File With Insecure Permissions
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during sh