diff --git a/pkgs/by-name/co/cotton/package.nix b/pkgs/by-name/co/cotton/package.nix
index 316dd23f6215d..0e85fb38c8f6f 100644
--- a/pkgs/by-name/co/cotton/package.nix
+++ b/pkgs/by-name/co/cotton/package.nix
@@ -26,5 +26,9 @@ rustPlatform.buildRustPackage rec {
       dit7ya
       figsoda
     ];
+
+    knownVulnerabilities = [
+      "'cotton' is vulnerable to CVE-2025-62518"
+    ];
   };
 }