From 26fa5cd1cdc8be4fbd4eb60c34a51c3196d3595a Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 21 Sep 2026 00:23:19 +0200
Subject: [PATCH] networkmanager-sstp: Mark as vulnerable to CVE-2026-91837

https://blogs.gnome.org/mcatanzaro/2026/09/15/privilege-escalation-vulnerabilities-in-networkmanager-plugins/

Unmaintained upstream and no patch currently available:
https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67

(cherry picked from commit 8eced6a02d4119f938c3bb792b2ed9c59a494b10)
---
 pkgs/by-name/ne/networkmanager-sstp/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/ne/networkmanager-sstp/package.nix b/pkgs/by-name/ne/networkmanager-sstp/package.nix
index 42df1b088fa8..e394ba6ba658 100644
--- a/pkgs/by-name/ne/networkmanager-sstp/package.nix
+++ b/pkgs/by-name/ne/networkmanager-sstp/package.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "NetworkManager's sstp plugin";
     inherit (networkmanager.meta) maintainers teams platforms;
+    knownVulnerabilities = [
+      "CVE-2026-91838"
+    ];
     license = lib.licenses.gpl2Plus;
   };
 }