EUVD-2026-20626Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate symlink in build chroot
-
ExploitRegister fixed-output derivation
-
ExecutionFollow symlink during output registration
-
ImpactOverwrite arbitrary files as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling UNIX symlink resolution
|
| Exploitation Conditions | Requires multi-user Nix installation on Linux with Nix daemon running as root. Attacker must control build inputs for fixed-output derivations in sandboxed builds. Local access needed to create malicious symlinks in build chroot during output registration phase. |
| Impact | Critical privilege escalation in multi-user Nix installations. Unauthenticated local attackers can exploit symlink-following during output registration to overwrite arbitrary files as root. CVSS 9.0 reflects severe impact (confidentiality, integrity) across system scope. High priority for any multi-user Nix deployment; single-user and macOS installations unaffected. |
| Exploit ScenarioDerived | Attacker submits a sandboxed derivation creating a symlink at the temporary output path pointing to sensitive system file (e.g., /etc/sudoers). During registration, Nix daemon follows symlink and overwrites target with derivation contents, achieving root-level file modification. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.28.6) allows unprivileged users to gain root access in multi-user Linux installations. Incomplete fix for CVE-2024-27297 permits symlink attacks during fixed-output derivation registration, enabling arbitrary file overwrites as root. Attackers exploit sandboxed build registration by placing symlinks in temporary output paths, causing the daemon to follow symlinks and overwrite sensitive system files with controlled content. Affects default configurations where all users can submit builds. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to Nix 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, or 2.28.6 depending on installed branch. Primary fix commits available at https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9, https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a, https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688, and https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a. Official security advisory: https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj. Temporary mitigation for multi-user installations: restrict allowed-users in nix.conf to trusted administrators only, preventing untrusted build submissions. Single-user installations (daemon not running as root) have reduced impact. Verify patched version post-upgrade via nix --version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 10 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-61 path traversal via symlink during output registration. The Nix daemon operates in host mount namespace while temporary output resides inside build chroot. Builder creates symlink at predictable temporary path; daemon follows symlink during file copy, writing derivation output to arbitrary filesystem locations. Sandboxing isolation failure between builder and daemon contexts enables privilege boundary violation.
Know when Nix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
Executive ViewAI
Nix package manager versions prior to 2.34.5 (and corresponding earlier branch versions) contain a local privilege escalation vulnerability that allows unprivileged users to gain root access on multi-user Linux systems. This directly undermines access controls in shared development and build environments, enabling attackers to compromise system integrity and install persistent backdoors. Organizations running Nix in multi-user configurations must prioritize immediate patching.
Apply vendor patch. If immediate patching is not possible: disable multi-user daemon access by restricting build submission permissions to root-only accounts; implement filesystem monitoring on /nix/store and system critical paths to detect unauthorized symlink creation or file overwrites; isolate affected Nix systems from production workloads until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the use
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2
Nix is a package manager for Linux and other Unix systems. Rated high severity (CVSS 8.8), this vulnerability is remotel
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate
An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-b
Nix releases before 2.35.3 in unsandboxed macOS or FreeBSD deployments permit a local authenticated build user to establ
Seatbelt sandbox escape on macOS in Nix before 2.35.3 and Lix before 2.95.4 lets a local attacker cause a crafted build
Local privilege escalation in Nix before 2.35.3 allows a local attacker with access to the user account that installed t
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recu
Exploit-DB