LuCI XSS, NixOS LLM policy, package CVEs

OpenWrt forum traffic around a new LuCI theme exposed an unauthenticated stored XSS path, while NixOS discourse heated over LLM-generated contribution text and several nixpkgs security trackers advanced. Flake aggregation and input hygiene proposals rounded out the day for packaging and plumbing maintainers.

OpenWrt LuCI Footstrap theme surfaces SVG XSS

A new LuCI theme named Footstrap, described as twice as fast as bootstrap, drew a long OpenWrt forum thread with dozens of participants. Discussion revealed a stored unauthenticated XSS issue: wallpaper uploads accepted as SVG and served with an image/svg+xml content type. LuCI remains the common web UI for OpenWrt devices, so the exposure matters for any instance that allows theme or wallpaper customization without authentication.

NixOS weighs explicit ban on LLM-generated PR text

NixOS contributors debated whether to forbid LLM-generated pull request descriptions and commit messages outright. Arguments invoked the spirit of existing contribution policy and the extractive, low-signal quality of such text. The heated exchange affects review load and norms for a large packaging project that already struggles with volume.

Immich shared-album takeover filed in nixpkgs

A nixpkgs issue ties CVE-2026-59258 to the security tracker: Immich versions before 3.0.3 allowed a shared album editor to take ownership via updateUser. Packaging maintainers use the report to drive version updates and advisories. Operators of the Immich package need the bump to close the privilege path.

Snipe-IT bulk-edit rights tracked for packaging

Nixpkgs records CVE-2026-48507 against Snipe-IT, where bulk user editing permitted non-admins to set ldap_import and activated_in fields. The tracker entry exists so the package can be patched or flagged. Sites that rely on the Nix-packaged asset manager inherit the elevated-edit risk until fixed.

Sickgear flagged for MITM remote code execution

A nixpkgs security report states that sickgear offers multiple routes for a man-in-the-middle attacker to reach remote code execution, via disabled TLS verification and unsafe download or execution paths. Maintainers and anyone running the package on untrusted networks face a direct compromise path. The issue awaits packaging response.

Omniflake aggregates thousands of GitHub flakes

Omniflake appeared on NixOS discourse as a single input that fronts roughly twelve thousand GitHub flakes. Early users reported sharply smaller lockfiles and fewer API rate-limit problems. The tool targets developers who pin many third-party flakes and want simpler dependency hygiene.

PSA favors nixos.org tarballs for flake inputs

A NixOS discourse post urged flake authors to prefer nixos.org channel tarballs over github: inputs, citing better compression and reduced GitHub dependence. The thread produced a pull request to change the default in nixos-generate-config. The shift improves fetch reliability and lockfile size for common NixOS configurations.

systemd Varlink race weakens logind SecureLocked

A systemd GitHub issue, raised via automated review, describes an unauthenticated Varlink Subscribe race that can defeat logind SecureLocked notifications. Follow-up comments examined the notification path. Session locking on systems that rely on those signals may be less reliable than intended until the race is closed.