From cb203e669def3e03d0006237ff21556e408277f9 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 10 Mar 2026 18:25:58 +0100 Subject: [PATCH] olivetin: add known vulnerabilities --- pkgs/by-name/ol/olivetin/package.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix index 764b66fd36fa..6adec86ce479 100644 --- a/pkgs/by-name/ol/olivetin/package.nix +++ b/pkgs/by-name/ol/olivetin/package.nix @@ -142,6 +142,16 @@ buildGoModule ( license = lib.licenses.agpl3Only; maintainers = with lib.maintainers; [ defelo ]; mainProgram = "OliveTin"; + knownVulnerabilities = [ + "CVE-2026-27626: OS Command Injection via password argument type and webhook JSON extraction bypasses shell safety checks" + "CVE-2026-28342: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint" + "CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes" + "CVE-2026-28789: Unauthenticated DoS via concurrent map writes in OAuth2 state handling" + "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session" + "CVE-2026-28790: Unauthenticated Action Termination via KillAction When Guests Must Login" + "CVE-2026-30233: View permission not being checked when returning dashboards" + "CVE-2026-30225: RestartAction always runs actions as guest" + ]; }; } )