Recent security vulnerabilities in Hydra
Announcements - NixOS Discourse
3 lis 2026, 19:00Nixos
1 min read
Two critical security vulnerabilities were disclosed today in the Hydra package manager, with fixes merged into the main codebase.
The first vulnerability is a path traversal flaw in the /log endpoint, which could be exploited to read arbitrary files from the $HYDRA_DATA directory. The second issue is a stored cross-site scripting (XSS) vulnerability affecting homepage links of projects and packages.
The fixes were merged into the NixOS/hydra repository on GitHub and are now available in the latest unstable version of Hydra, which has been bumped in Nixpkgs.
Related
Article written by AI
Z.ai GLM-4.7-FlashFree