NixOS nix vulnerabilities
20 published CVEs name NixOS nix among the affected products.
- 20Published CVEs20 of them scored
- 9Last 12 monthspublished in the last year
- 2Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-110453
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
NixOS · Nix
Medium4.3 - CVE-2026-110452
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root…
NixOS · Nix
Medium4.0 - CVE-2026-110451
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
NixOS · Nix
Medium4.3 - CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content…
NixOS · Nix
High8.0 - CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list…
NixOS · Nix
High7.5 - CVE-2026-64846
Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
NixOS · nix
Low2.8 - CVE-2026-44029
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack"…
NixOS · Nix
Medium5.3 - CVE-2026-44028
An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow…
NixOS · Nix
High7.5 - CVE-2026-39860
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
NixOS · nix
Critical9.0 - CVE-2025-53819
Nix's privilege dropping to build user broke for macOS
NixOS · nix
High7.9