NixOS Nix

• CVE-2026-110453 Medium 4.3 Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. 0.1%
• CVE-2026-110452 Medium 4.0 The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership. 0.1%
• CVE-2026-110451 Medium 4.3 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled. 0.1%
• CVE-2026-110450 High 8.0 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. 0.2%
• CVE-2026-110449 High 7.5 Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. 0.2%
• CVE-2026-64846 Low 2.8 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature 0.1%
• CVE-2026-44029 Medium 5.3 An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.3 0.6%
• CVE-2026-44028 High 7.5 An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine sta 0.2%
• CVE-2026-39860 Critical 9.0 Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination 0.2%
• CVE-2025-53819 High 7.9 Nix's privilege dropping to build user broke for macOS 0.1%
• CVE-2025-52992 Low 3.2 The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox 0.2%
• CVE-2025-52993 Medium 5.6 A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix befor 0.1%
• CVE-2025-52991 Low 3.2 The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into usi 0.2%
• CVE-2025-46416 Low 2.9 The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2 0.2%
• CVE-2025-46415 Low 3.2 A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2 0.1%
• CVE-2024-51481 Low 1.0 Nix allows macOS sandbox escape via built-in builders 0.2%
• CVE-2024-47174 Medium 5.9 Credential leak when credentials are used with `<nix/fetchurl.nix>` 0.3%
• CVE-2024-45593 Critical 9.1 Nix affected by unsafe NAR unpacking 0.6%
• CVE-2024-38531 Low 3.6 Nix sandbox escape 0.1%
• CVE-2024-27297 Medium 6.3 Nix Corruption of fixed-output derivations 0.6%