Threats affecting pkg:github/nixos/nix

CVE-2026-64846 is a vulnerability in the Nix package manager prior to version 2.35.0. It involves a time-of-check/time-of-use (TOCTOU) race condition related to symbolic link handling during the LocalStore restore path when using the recursive-nix experimental feature. This race condition can allow the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The vulnerability does not allow arbitrary content writes and requires winning the race. The issue is fixed in version 2.35.0.

CVE-2026-39860 is a critical vulnerability in the Nix package manager affecting Linux sandboxed builds. It arises from a flaw in the fix for a previous vulnerability (CVE-2024-27297) that allows arbitrary file overwrites by following symbolic links during fixed-output derivation output registration. This can be exploited by users who can submit builds to the Nix daemon, potentially leading to root privilege escalation by overwriting sensitive files. The issue does not affect sandboxed macOS builds. Multiple versions of Nix prior to specific fixed releases are vulnerable. The vulnerability has a CVSS score of 9. A fix is available in Nix versions 2.28.6, 2.29.

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.