[Git][security-tracker-team/security-tracker][master] Add CVE-2026-64846/nix

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
92621d7f by Salvatore Bonaccorso at 2026-08-21T09:47:43+02:00
Add CVE-2026-64846/nix

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -336,7 +336,10 @@ CVE-2026-64961 (ATutor is vulnerable to authentication bypass .Although a token
 CVE-2026-64960 (ATutor Gameme module allows users to upload files of any type and exte ...)
 	NOT-FOR-US: ATutor
 CVE-2026-64846 (Nix is a package manager for Linux and other Unix systems. Prior to 2. ...)
-	TODO: check
+	- nix <unfixed>
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f
+	NOTE: https://github.com/NixOS/nix/pull/15401
+	NOTE: Fixed by: https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390 (2.35.0)
 CVE-2026-64777 (A malicious builder peer may be able to request an in-context file by  ...)
 	NOT-FOR-US: Apple
 CVE-2026-63654 (Frappe is a full-stack web application framework. In version 16.31.0 a ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/92621d7f41564e9930461cc3b45f46252f0ee808

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/92621d7f41564e9930461cc3b45f46252f0ee808
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260821/b4cf0a9d/attachment.htm>