PT-2026-31315 · Nix · Nix

Published 2026-04-07 · Updated 2026-04-17 · CVE-2026-39860

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.34.5 Nix versions prior to 2.33.4 Nix versions prior to 2.32.7 Nix versions prior to 2.31.4 Nix versions prior to 2.30.4 Nix versions prior to 2.29.3 Nix versions prior to 2.28.6

Description A flaw exists in the fix for a previous issue that allows for arbitrary overwrites of files writable by the Nix process, particularly in multi-user installations where the Nix daemon runs as root. This impacts sandboxed Linux builds, while sandboxed macOS builds are not affected. The vulnerability arises from the ability to create symlinks pointing to arbitrary filesystem locations during build output registration. When the Nix process follows these symlinks, it can overwrite files, potentially granting unauthorized users root privileges by modifying sensitive files.

Recommendations Update to Nix version 2.34.5 or later. Update to Nix version 2.33.4 or later. Update to Nix version 2.32.7 or later. Update to Nix version 2.31.4 or later. Update to Nix version 2.30.4 or later. Update to Nix version 2.29.3 or later. Update to Nix version 2.28.6 or later.

Fix

LPE

Weakness Enumeration

CWE-61

Related Identifiers

BDU:2026-05268

CVE-2026-39860

Affected Products

Nix

References · 21

• https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a · Patch
• https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj · Vendor Advisory
• https://github.com/NixOS/nix/pull/10178 · Patch
• https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9 · Patch
• https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688 · Patch
• https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39860 · Security Note
• https://bdu.fstec.ru/vul/2026-05268 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39860 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39860 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39860 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-39860 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39860 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2041986824675930150 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042001005986955529 · Twitter Post