https://seclists.org/oss-sec/2026/q4/150: Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026
Published Oct 13, 2026
·Updated
Affected Software
2 affected components
NixOS Nix<=2.35.2, <=2.34.8, <=2.31.5, <=2.30.5, <=2.28.7
Lix Lix<=2.95.3, <=2.94.2, <=2.93
Frequently Asked Questions
1
Are fixes available for both affected projects?
Yes. Fixed releases of both Nix and Lix were available at the time of disclosure, but the advisory does not provide the fixed version numbers.
2
What attacker-controlled input is required for the list allocation issue?
The heap out-of-bounds write occurs while evaluating untrusted Nix expressions. Systems that do not evaluate expressions supplied by untrusted local users are not described as exposed through this issue.
3
When does the macOS sandbox escape occur?
It requires a generated Seatbelt sandbox profile to cross an internal size threshold at a missing optional path. Under that condition, an unqualified allow rule can be emitted and the build runs without confinement.
4
Do the disclosed issues have final CVE identifiers?
No. The disclosure states that CVE IDs had not yet been requested and uses placeholder CVE identifiers for the listed issues.