Nixos Nixpkgs vulnerabilities

CVE-2026-25740 [MEDIUM] CWE-250 CVE-2026-25740: captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS se captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulne

CVE-2026-25137 [CRITICAL] CWE-306 CVE-2026-25137: The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, e The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests.

CVE-2026-23838 [HIGH] CWE-538 CVE-2026-23838: Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is tha

CVE-2025-64766 [MEDIUM] CWE-798 CVE-2025-64766: NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, co NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an exi

CVE-2025-32438 [HIGH] CWE-378 CVE-2025-32438: make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation aff make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shut