diff --git a/pkgs/by-name/co/cotton/package.nix b/pkgs/by-name/co/cotton/package.nix
index 1d0de589da87..cfa45e587c4f 100644
--- a/pkgs/by-name/co/cotton/package.nix
+++ b/pkgs/by-name/co/cotton/package.nix
@@ -26,5 +26,9 @@ rustPlatform.buildRustPackage {
       dit7ya
       figsoda
     ];
+
+    knownVulnerabilities = [
+      "'cotton' is vulnerable to CVE-2025-62518"
+    ];
   };
 }