CVE-2026-64846: falha de baixa gravidade em NixOS nix
Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.8epss 0.1%
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
NixOS · nixCVEs relacionadas — NixOS nix
No mesmo produto, das mais perigosas para as menos.
CVE-2024-45593CRITICALNix affected by unsafe NAR unpackingEPSS 0.6%CVE-2024-27297MEDIUMNix Corruption of fixed-output derivationsEPSS 0.6%CVE-2024-47174MEDIUMCredential leak when credentials are used with `<nix/fetchurl.nix>`EPSS 0.3%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-51481LOWNix allows macOS sandbox escape via built-in buildersEPSS 0.2%CVE-2025-53819HIGHNix's privilege dropping to build user broke for macOSEPSS 0.1%