CVE-2026-39860
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A bug in the fix for CVE-2024-27297 in Nix allows arbitrary overwrites of files writable by the Nix process by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds only.
Risk Assessment
In multi-user installations, any user able to submit builds to the Nix daemon can gain root privileges by overwriting sensitive files.
Recommendation
Update Nix to one of the patched versions: 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, or 2.28.6.
Other vulnerabilities in Nix
See all- CVE-2026-110453Medium
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
- CVE-2026-110452Medium
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer, even though it should be root ownership.
- CVE-2026-110451Medium
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
- CVE-2026-110450High
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.
- CVE-2026-110449High
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. This can lead to memory corruption and potential code execution.
- CVE-2026-64846Low
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
- CVE-2026-44029Medium
In Nix before 2.34.7, writing to arbitrary files can occur via directory traversal in "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack". Fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7).
Original NVD description (English source)
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS