Security advisory for Nix and Lix - October 2026

Nix and Lix are affected by a set of issues that can be combined to achieve

• CVE-2026-XXXXX — an
• CVE-2026-XXXXX —repair operations could destroy and replace a legitimate
• CVE-2026-XXXXX — a(allow …) form could be

  This is a coordinated disclosure between the Nix and Lix projects, with the

  Additionally, there are several Nix-specific issues that are fixed in this securitynot affect Lix:

  • GHSA-hf6w-2rg9-v84g,CVE_2026-XXXXX — a bug in
  • GHSA-92x5-h528-wrmw,CVE_2026-XXXXX — improper authorisationrepair exploit.Am I affected?

    All systems that build untrusted derivations are impacted.

    • The list-allocation overflow affects any evaluation of untrusted Nix code:nix eval, builds, and anything else that evaluates expressions from
    • The repair privilege escalation affect multi-user daemon installations where
    • The Seatbelt escape affects macOS only, and only when sandbox = true orsandbox = relaxed is configured. sandbox defaults to false on macOS,

      Nix:

      • Installer permission issue affects fresh installations that used https://nixos.org/nix/install--daemon flag explicitly, or by default on macOS).nix upgrade-nix)Patches

        The following versions contain the fixes. Versions older than the listed ones

        Nix

        • Affected versions: ≤ 2.35.2, ≤ 2.34.8, ≤ 2.31.5, ≤ 2.30.5, ≤ 2.28.7
        • Fixed versions: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8
        • Older versions are impacted to varying degrees and should be assumed vulnerable.

          If you have installed Nix via https://nixos.org/nix/install,

          nix upgrade-nix --upgrade-nix-store-path-url https://releases.nixos.org/nix/nix-<version>/fallback-paths.nix
          

          Where <version> corresponds to the fixed patch version of the minor release of Nix that you currently have installed.

          Lix

          • Affected versions: ≤ 2.94.2, ≤ 2.95.3
          • Fixed versions: 2.94.3, 2.95.4
          • Older branches (2.93 and older) are also impacted, but are no longer

            Lix 2.95.4 can be upgraded with the helper script:

            curl -sSf -L "https://git.lix.systems/lix-project/lix/raw/tag/2.95.4/misc/upgrade-lix.sh" \
              | sudo --preserve-env=PATH bash -s -- 2.95.4
            

            Lix 2.94.3 can be upgraded with nix upgrade-nix.

            nixpkgs

            The issues have been fixed in the following nixpkgs PRs. Each PR has aMaking sure you're not a bot! <number>.

            • NixOS unstable:
              
              • Nix: TODO
              • Lix: TODO
            • NixOS 26.05:
              
              • Nix: TODO
              • Lix: TODO
            Acknowledgement

            We would like to thank:

            References
            • Lix: TODO.
            • Nix: TODO.

            1 post - 1 participant

            Read full topic