CVE-2026-39860

Published: Apr 08, 2026 Last Modified: Apr 15, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,0
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: none

Description

AI Translation Available

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0002
Percentile
0,0th
Updated

EPSS Score Trend (Last 8 Days)

61

UNIX Symbolic Link (Symlink) Following

Incomplete
Abstraction: Compound Structure: Composite
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Files Or Directories Modify Files Or Directories
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.21.0 (inclusive)
To 2.28.6 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.31.0 (inclusive)
To 2.31.4 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.29.0 (inclusive)
To 2.29.3 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.20.5 (inclusive)
To 2.20.9 (inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.33.0 (inclusive)
To 2.33.4 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.18.2 (inclusive)
To 2.18.9 (inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.30.0 (inclusive)
To 2.30.4 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.32.0 (inclusive)
To 2.32.7 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.19.4 (inclusive)
To 2.19.7 (inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Nix by Nixos

Product Information
Vendor Nixos
Product Nix
Version Range Affected
From 2.34.0 (inclusive)
To 2.34.5 (exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a…
https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3…
https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
https://github.com/NixOS/nix/commit/7794354a982449927ee7401…
https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e37…
https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
https://github.com/NixOS/nix/pull/10178
https://github.com/NixOS/nix/pull/10178
https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-…
https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj