CVE-2026-64846
LowCVSS 2.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Risk Assessment
The risk includes the possibility of manipulating files outside the build sandbox, potentially leading to system integrity compromise or privilege escalation in the Nix environment.
Recommendation
It is recommended to upgrade Nix to version 2.35.0 or later and avoid using the experimental recursive-nix feature in production environments.
Other vulnerabilities in Nix
See all- CVE-2026-39860Critical
A bug in the fix for CVE-2024-27297 in Nix allows arbitrary overwrites of files writable by the Nix process by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds only.
- CVE-2026-110453Medium
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
- CVE-2026-110452Medium
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer, even though it should be root ownership.
- CVE-2026-110451Medium
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
- CVE-2026-110450High
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.
- CVE-2026-110449High
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. This can lead to memory corruption and potential code execution.
- CVE-2026-44029Medium
In Nix before 2.34.7, writing to arbitrary files can occur via directory traversal in "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack". Fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7).
Original NVD description (English source)
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS