Unverified Commit ce1a7c1f authored by Nikolay Korotkiy's avatar Nikolay Korotkiy Committed by GitHub
Browse files

localsend: patch CVE-2026-25154 (#488826)

parents c5934e87 ebc5c1b1

pkgs/by-name/lo/localsend/package.nix

+13 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
  libayatana-appindicator,

  undmg,

  makeBinaryWrapper,

  fetchpatch,

}:



let
@@ -35,6 +36,18 @@ let 
      pasteboard = "sha256-lJA5OWoAHfxORqWMglKzhsL1IFr9YcdAQP/NVOLYB4o=";

    };



    patches = [

      # Fix for https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4

      # See: https://github.com/NixOS/nixpkgs/issues/488755

      # Can be removed with new release > 1.17.0

      (fetchpatch {

        url = "https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c.patch";

        hash = "sha256-Fswir+TebCDPxHVBg8YM3ROx2uoLG92E3E15wnzHz+U=";

      })

    ];



    patchFlags = [ "-p2" ];



    postPatch = ''

      substituteInPlace lib/util/native/autostart_helper.dart \

        --replace-fail 'Exec=''${Platform.resolvedExecutable}' "Exec=localsend_app"