An issue was discovered in Nix before 2.34.7. (CVE-2026-44029)

CVE-2026-44029 is a directory traversal vulnerability in Nix versions prior to 2.34.7, introduced in 2.24.7. It allows an attacker to write to arbitrary files by exploiting the 'nix-prefetch-url --unpack' or 'nix store prefetch-file --unpack' commands. This can lead to integrity compromise of the system or files. The vulnerability has been addressed in versions 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7. The CVSS v3.1 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows an unauthenticated attacker to write to arbitrary files on the system by exploiting directory traversal in specific Nix commands. This can lead to unauthorized modification of files, potentially affecting system integrity. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Upgrade Nix to version 2.34.7 or later. Alternatively, apply any of the fixed versions 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, or 2.28.7 if applicable. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's fixed version releases.