Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

Hello,

The Nix and Lix projects are jointly disclosing a set of vulnerabilities that can be combined to escalate privileges to root on systems running the Nix or Lix daemon. Fixed releases of both projects are available today. This is a coordinated disclosure between the Nix and Lix projects. CVE IDs have not yet been requested.

Issues affecting both Nix and Lix =========================

CVE-2026-XXXXX [list overflow] Unsigned integer overflow when allocating Nix lists. It leads to a heap out-of-bounds write while evaluating untrusted Nix expressions.

CVE-2026-XXXXX [repair] Unprivileged repair operations could delete and replace a legitimate store path before its contents were verified. This leads to local privilege escalation.

CVE-2026-XXXXX [seatbelt] macOS Seatbelt sandbox escape. When the generated sandbox profile crossed an internal size threshold at a missing optional path, an unqualified (allow ...) form could be emitted. The build then ran unconfined.

Issues affecting Nix only (Lix is not affected) ==================================

CVE-2026-XXXXX [installer], GHSA-hf6w-2rg9-v84g Bug in the multi-user installer. The script left the contents of the store (not the store directory itself) owned by the invoking user rather than root.

CVE-2026-XXXXX [daemon authz], GHSA-92x5-h528-wrmw Improper authorisation of Nix daemon clients. Unsandboxed configurations on macOS and FreeBSD did not reject connections from build users. This makes the repair issue above more severe.

Am I affected? ===========

All systems that build untrusted derivations are affected.

- List overflow: affects any evaluation of untrusted Nix code, including nix eval, builds, and anything else that evaluates expressions from untrusted sources. In Nix, the impact depends on the optimisations performed by the compiler used to build Nix.

- Repair privilege escalation: affects multi-user daemon installations where unprivileged users can connect to the daemon, on both Linux and macOS.

- Seatbelt escape: macOS only, and only when sandbox = true or sandbox = relaxed is configured. sandbox defaults to false on macOS. The escape can be triggered deliberately, and in some configurations by accident.

Affected and fixed versions =====================

Nix Affected: <= 2.35.2, <= 2.34.8, <= 2.31.5, <= 2.30.5, <= 2.28.7 Fixed: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8 Older versions are impacted to varying degrees and should be assumed vulnerable. 2.29.x, 2.32.x and 2.33.x lineages are no longer maintained and will not receive these fixes.

Lix Affected: <= 2.95.3, <= 2.94.2 Fixed: 2.95.4, 2.94.3 The 2.93 branch and older are also affected. They are no longer maintained and will not receive fixes.

References =========

[1] Lix blogpost announcement: https://lix.systems/blog/2026-10-13-lix-cves/ [2] Shared announcement on NixOS Discourse forum: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547 [3] Nix list overflow GHSA: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g [4] Nix repair GHSA: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56 [5] Nix seatbelt GHSA: https://github.com/NixOS/nix/security/advisories/GHSA-m4vq-qf6v-82pj [6] Nix installer GHSA: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g [7] Nix daemon auth GHSA: https://github.com/NixOS/nix/security/advisories/GHSA-92x5-h528-wrmw

Hello everyone,

The Lix issue has been assigned CVE-2026-44028 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). The Lix team has published a detailed blog post about it here for those of you wanting extra details: https://lix.systems/blog/2026-05-05-lix-unsigned-integer-overflow/

We are currently having some troubles getting this CVE split from the Nix issue GHSA-vh5x-56v6-4368 and updated accordingly. While both vulnerabilities could lead to similar compromises and were discovered around the same time, they do not share the same root cause.

The other Nix vulnerability, GHSA-gr92-w2r5-qw5p, has been assigned CVE-2026-44029.

Le lun. 4 mai 2026 à 23:06, Thomas GERBET <thomas () gerbet me> a écrit : Summary

Nix and Lix daemon implementations are affected by buffer overflows vulnerabilities that allow a local attacker to gain arbitrary code execution as the daemon user (root in multi-user installations).

The vulnerabilities are identified as: - Nix: GHSA-vh5x-56v6-4368, CVE ID pending attribution. - Lix: CVE ID pending attribution.

This is a coordinated disclosure between the Nix and Lix projects.

Guix is NOT affected by this vulnerability.

Am I affected?

To exploit this issue, a local attacker needs access to talk to the Nix daemon. All systems that allow connections to their daemons are affected. Only users that are allowed to connect to the daemon (via allowed-users and trusted-users) can reliably trigger the issue. Substituters can in theory trigger the issue but cannot make enough attempts to mount attacks in practice.

Additionally, this vulnerability requires ASLR weakening techniques to lead to a compromise.

Fixes

The vulnerabilities are fixed in the following versions:

- Nix: - Affected versions: ≥ 2.24.4 - Fixed versions: 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7

Nix security release also includes patches that address an unrelated path traversal vulnerability GHSA-gr92-w2r5-qw5p (CVE ID pending attribution).

- Lix: - Affected versions: ≥ 2.93.0 - Fixed versions: 2.93.4, 2.94.2, 2.95.2

Acknowledgement

- We would like to thank @edef with the help of Sander (@sandydoo) for reporting the issues and working with the development teams to suggest and confirm the fixes. - Thanks to eldritch horrors (@pennae) and Raito Bezarius (@RaitoBezarius) on the Lix side for the mitigation. - Thanks to @xokdvium on the Nix side for the mitigation. - Thanks to @hexa and @tgerbet on the NixOS security team for coordinating this.

References

https://discourse.nixos.org/t/security-advisory-local-privilege-escalation-in-lix-and-nix/77407 Nix issues: - https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368 - https://github.com/NixOS/nix/security/advisories/GHSA-gr92-w2r5-qw5p Lix in-depth review blog post: not yet published

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).

Summary

Nix and Lix daemon implementations are affected by buffer overflows vulnerabilities that allow a local attacker to gain arbitrary code execution as the daemon user (root in multi-user installations).

The vulnerabilities are identified as: - Nix: GHSA-vh5x-56v6-4368, CVE ID pending attribution. - Lix: CVE ID pending attribution.

This is a coordinated disclosure between the Nix and Lix projects.

Guix is NOT affected by this vulnerability.

Am I affected?

To exploit this issue, a local attacker needs access to talk to the Nix daemon. All systems that allow connections to their daemons are affected. Only users that are allowed to connect to the daemon (via allowed-users and trusted-users) can reliably trigger the issue. Substituters can in theory trigger the issue but cannot make enough attempts to mount attacks in practice.

Additionally, this vulnerability requires ASLR weakening techniques to lead to a compromise.

Fixes

The vulnerabilities are fixed in the following versions:

- Nix: - Affected versions: ≥ 2.24.4 - Fixed versions: 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7

Nix security release also includes patches that address an unrelated path traversal vulnerability GHSA-gr92-w2r5-qw5p (CVE ID pending attribution).

- Lix: - Affected versions: ≥ 2.93.0 - Fixed versions: 2.93.4, 2.94.2, 2.95.2

Acknowledgement

- We would like to thank @edef with the help of Sander (@sandydoo) for reporting the issues and working with the development teams to suggest and confirm the fixes. - Thanks to eldritch horrors (@pennae) and Raito Bezarius (@RaitoBezarius) on the Lix side for the mitigation. - Thanks to @xokdvium on the Nix side for the mitigation. - Thanks to @hexa and @tgerbet on the NixOS security team for coordinating this.

References

https://discourse.nixos.org/t/security-advisory-local-privilege-escalation-in-lix-and-nix/77407 Nix issues: - https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368 - https://github.com/NixOS/nix/security/advisories/GHSA-gr92-w2r5-qw5p Lix in-depth review blog post: not yet published

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld or guixbuild). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.