NI
Product
nix
21
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 7Medium 7Low 7
Watch
Add nix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45593 | 8.8 | Sep 10 | Nix affected by unsafe NAR unpacking Affected: >= 2.24.0, < 2.24.6 |
| CVE-2026-39860 | 8.4 | Apr 8 | Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination Affected: >= 2.21, < 2.28.6; >= 2.29.0, < 2.29.3; >= 2.30.0, < 2.30.4; >= 2.31.0, < 2.31.4; >= 2.32.0, < 2.32.7; >= 2.33.0, < 2.33.4; +4 more |
| CVE-2026-110450 | 8.0 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2025-53819 | 7.9 | Jul 14 | Nix's privilege dropping to build user broke for macOS Affected: = 2.30.0 |
| CVE-2019-17365 | 7.8 | Oct 9 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable Affected: through 2.3 |
| CVE-2026-110449 | 7.5 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-44028 | 7.5 | May 5 | An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2 Affected: 2.24.4 before 2.28.7; 2.29.0 before 2.29.4; 2.30.0 before 2.30.5; 2.31.0 before 2.31.5; 2.32.0 before 2.32.8; 2.33.0 before 2.33.6; +1 more |
| CVE-2024-47174 | 5.9 | Sep 26 | Credential leak when credentials are used with `<nix/fetchurl.nix>` Affected: >= 1.11, < 2.18.8; >= 2.24.0, < 2.24.8 |
| CVE-2024-27297 | 5.9 | Mar 11 | Nix Corruption of fixed-output derivations Affected: >= 2.3.0, < 2.3.18; >= 2.4.0, < 2.18.2; >= 2.19.0, < 2.19.4; >= 2.20.0, < 2.20.5 |
| CVE-2025-52993 | 5.6 | Jun 27 | A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*) Affected: before 2.24.15; 2.25.0 before 2.26.4; 2.27.0 before 2.28.4; 2.29.0 before 2.29.1 |
| CVE-2026-44029 | 5.3 | May 5 | An issue was discovered in Nix before 2.34.7 Affected: 2.24.7 before 2.28.7; 2.29.0 before 2.29.4; 2.30.0 before 2.30.5; 2.31.0 before 2.31.5; 2.32.0 before 2.32.8; 2.33.0 before 2.33.6; +1 more |
| CVE-2026-110453 | 4.3 | Oct 14 | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-110451 | 4.3 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-110452 | 4.0 | Oct 14 | The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2024-38531 | 3.6 | Jun 28 | Nix sandbox escape Affected: >= 2.23.0, < 2.23.1; >= 2.22.0, < 2.22.2; >= 2.21.0, < 2.21.3; >= 2.20.0, < 2.20.7; >= 2.19.0, < 2.19.5; >= 2.18.0, < 2.18.4 |
| CVE-2025-52992 | 3.2 | Jun 27 | The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails Affected: before 2.24.15; 2.25.0 before 2.26.4; 2.27.0 before 2.28.4; 2.29.0 before 2.29.1 |
| CVE-2025-52991 | 3.2 | Jun 27 | The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location Affected: before 2.24.15; 2.25.0 before 2.26.4; 2.27.0 before 2.28.4; 2.29.0 before 2.29.1 |
| CVE-2025-46415 | 3.2 | Jun 27 | A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders Affected: before 2.24.15; 2.25.0 before 2.26.4; 2.27.0 before 2.28.4; 2.29.0 before 2.29.1 |
| CVE-2025-46416 | 2.9 | Jun 27 | The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild) Affected: through 2.24.15; 2.25.0 through 2.26.4; 2.27.0 through 2.28.4; 2.29.0 through 2.29.1 |
| CVE-2026-64846 | 2.8 | Aug 20 | Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature Affected: < 2.35.0 |
| CVE-2024-51481 | 1.0 | Oct 31 | Nix allows macOS sandbox escape via built-in builders Affected: < 2.18.9; >= 2.19.0, < 2.19.7, 2.20.9, 2.21.5, 2.22.4, 2.23.4, 2.24.10; >= 2.20.0, < 2.20.9; >= 2.21.0, < 2.21.5; >= 2.22.0, < 2.22.4; >= 2.23.0, < 2.23.4; +1 more |
Showing 21