Vulnerability-Lookup

CVE-2026-39860 (GCVE-0-2026-39860)

Vulnerability from cvelistv5 – Published: 2026-04-08 20:58 – Updated: 2026-04-09 13:42

Title

Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination

Summary

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/NixOS/nix/security/advisories/…	x_refsource_CONFIRM
https://github.com/NixOS/nix/pull/10178	x_refsource_MISC
https://github.com/NixOS/nix/commit/244f3eee0bbc7…	x_refsource_MISC
https://github.com/NixOS/nix/commit/4bc5a3510fa37…	x_refsource_MISC
https://github.com/NixOS/nix/commit/7794354a98244…	x_refsource_MISC
https://github.com/NixOS/nix/commit/a3163b9eabb95…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
NixOS	nix	Affected: >= 2.21, < 2.28.6 Affected: >= 2.29.0, < 2.29.3 Affected: >= 2.30.0, < 2.30.4 Affected: >= 2.31.0, < 2.31.4 Affected: >= 2.32.0, < 2.32.7 Affected: >= 2.33.0, < 2.33.4 Affected: >= 2.34.0, < 2.34.5 Affected: >= 2.20.5, <= 2.20.9 Affected: >= 2.19.4, <= 2.19.7 Affected: >= 2.18.2, <= 2.18.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T13:42:26.389636Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T13:42:36.997Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nix",
          "vendor": "NixOS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.21, \u003c 2.28.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.29.0, \u003c 2.29.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.30.0, \u003c 2.30.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.31.0, \u003c 2.31.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.32.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.33.0, \u003c 2.33.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.34.0, \u003c 2.34.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.20.5, \u003c= 2.20.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.4, \u003c= 2.19.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.18.2, \u003c= 2.18.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation\u0027s output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T20:58:22.979Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj"
        },
        {
          "name": "https://github.com/NixOS/nix/pull/10178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NixOS/nix/pull/10178"
        },
        {
          "name": "https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9"
        },
        {
          "name": "https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a"
        },
        {
          "name": "https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688"
        },
        {
          "name": "https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a"
        }
      ],
      "source": {
        "advisory": "GHSA-g3g9-5vj6-r3gj",
        "discovery": "UNKNOWN"
      },
      "title": "Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39860",
    "datePublished": "2026-04-08T20:58:22.979Z",
    "dateReserved": "2026-04-07T19:13:20.379Z",
    "dateUpdated": "2026-04-09T13:42:36.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-39860",
      "date": "2026-08-04",
      "epss": "0.00193",
      "percentile": "0.09235"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-39860\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-08T21:17:00.157\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation\u0027s output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.\"},{\"lang\":\"es\",\"value\":\"Nix es un gestor de paquetes para Linux y otros sistemas Unix. Un error en la correcci\u00f3n para CVE-2024-27299 permiti\u00f3 sobrescrituras arbitrarias de archivos escribibles por el proceso Nix que orquesta las compilaciones (t\u00edpicamente el demonio Nix ejecut\u00e1ndose como root en instalaciones multiusuario) al seguir enlaces simb\u00f3licos durante el registro de salida de derivaciones de salida fija. Esto afecta a las compilaciones de Linux en entornos aislados; las compilaciones de macOS en entornos aislados no se ven afectadas. La ubicaci\u00f3n de la salida temporal utilizada para la copia de salida se encontraba dentro del chroot de compilaci\u00f3n. Un enlace simb\u00f3lico, apuntando a una ubicaci\u00f3n arbitraria en el sistema de archivos, podr\u00eda ser creado por el constructor de la derivaci\u00f3n en esa ruta. Durante el registro de salida, el proceso Nix (ejecut\u00e1ndose en el espacio de nombres de montaje del host) seguir\u00eda ese enlace simb\u00f3lico y sobrescribir\u00eda el destino con el contenido de salida de la derivaci\u00f3n. En instalaciones multiusuario, esto permite a todos los usuarios capaces de enviar compilaciones al demonio Nix (usuarios permitidos - por defecto todos los usuarios) obtener privilegios de root modificando archivos sensibles. Esta vulnerabilidad est\u00e1 corregida en 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3 y 2.28.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"NixOS\",\"product\":\"nix\",\"versions\":[{\"version\":\"\u003e= 2.21, \u003c 2.28.6\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.29.0, \u003c 2.29.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.30.0, \u003c 2.30.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.31.0, \u003c 2.31.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.32.0, \u003c 2.32.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.33.0, \u003c 2.33.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.34.0, \u003c 2.34.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.20.5, \u003c= 2.20.9\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.19.4, \u003c= 2.19.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.18.2, \u003c= 2.18.9\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":5.8},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.0,\"impactScore\":5.8}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-09T13:42:26.389636Z\",\"id\":\"CVE-2026-39860\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-61\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.18.2\",\"versionEndIncluding\":\"2.18.9\",\"matchCriteriaId\":\"88A1E0DB-FA70-449D-B872-6C8051A7A8A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.19.4\",\"versionEndIncluding\":\"2.19.7\",\"matchCriteriaId\":\"F6D346F6-DF4F-4DFA-A5C8-16D620B5573C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.20.5\",\"versionEndIncluding\":\"2.20.9\",\"matchCriteriaId\":\"57A0A4D2-47CF-4E82-85D0-504EF978279F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.21.0\",\"versionEndExcluding\":\"2.28.6\",\"matchCriteriaId\":\"169A0D33-C7A8-4D02-A560-3F6ED2DF29D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.29.0\",\"versionEndExcluding\":\"2.29.3\",\"matchCriteriaId\":\"48408418-40B9-4657-836F-37C964B9F5B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.30.0\",\"versionEndExcluding\":\"2.30.4\",\"matchCriteriaId\":\"C475C811-04D0-48E3-B302-A6980376BEF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.31.0\",\"versionEndExcluding\":\"2.31.4\",\"matchCriteriaId\":\"25E84672-263F-4C99-8698-EC5BC3FF4AC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.32.0\",\"versionEndExcluding\":\"2.32.7\",\"matchCriteriaId\":\"C9E39F02-7238-4B3C-8DDD-EED01C4C9664\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.33.0\",\"versionEndExcluding\":\"2.33.4\",\"matchCriteriaId\":\"5BD5E589-D0F6-4C4F-8831-E9B29C842B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.34.0\",\"versionEndExcluding\":\"2.34.5\",\"matchCriteriaId\":\"FC7B6CF8-F460-4C0E-9526-E3C3BEE613EA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"}]}]}],\"references\":[{\"url\":\"https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/NixOS/nix/pull/10178\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T11:39:18+00:00",
      "cve": "CVE-2026-39860",
      "id": "CVE-2026-39860",
      "initial_release_date": "2026-04-08T20:58:22.979000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "nix: privilege escalation via symlink following during output registration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39860.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-04-10T23:25:04Z",
      "cve": "CVE-2026-39860",
      "id": "CVE-2026-39860",
      "initial_release_date": "2026-04-10T23:25:04Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-39860",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-39860.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39860\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-09T13:42:26.389636Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-09T13:42:31.427Z\"}}], \"cna\": {\"title\": \"Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination\", \"source\": {\"advisory\": \"GHSA-g3g9-5vj6-r3gj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"NixOS\", \"product\": \"nix\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.21, \u003c 2.28.6\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.29.0, \u003c 2.29.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.30.0, \u003c 2.30.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.31.0, \u003c 2.31.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.32.0, \u003c 2.32.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.33.0, \u003c 2.33.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.34.0, \u003c 2.34.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.20.5, \u003c= 2.20.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.19.4, \u003c= 2.19.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.18.2, \u003c= 2.18.9\"}]}], \"references\": [{\"url\": \"https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj\", \"name\": \"https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/NixOS/nix/pull/10178\", \"name\": \"https://github.com/NixOS/nix/pull/10178\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9\", \"name\": \"https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a\", \"name\": \"https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688\", \"name\": \"https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a\", \"name\": \"https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation\u0027s output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-61\", \"description\": \"CWE-61: UNIX Symbolic Link (Symlink) Following\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-08T20:58:22.979Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-39860\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-09T13:42:36.997Z\", \"dateReserved\": \"2026-04-07T19:13:20.379Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-08T20:58:22.979Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-39860

Vulnerability from fkie_nvd - Published: 2026-04-08 21:17 - Updated: 2026-06-17 10:42

Severity

9.0 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9	Patch
security-advisories@github.com	https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a	Patch
security-advisories@github.com	https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688	Patch
security-advisories@github.com	https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a	Patch
security-advisories@github.com	https://github.com/NixOS/nix/pull/10178	Issue Tracking, Patch
security-advisories@github.com	https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj	Mitigation, Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
nixos	nix	*
linux	linux_kernel	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nix",
          "vendor": "NixOS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.21, \u003c 2.28.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.29.0, \u003c 2.29.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.30.0, \u003c 2.30.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.31.0, \u003c 2.31.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.32.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.33.0, \u003c 2.33.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.34.0, \u003c 2.34.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.20.5, \u003c= 2.20.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.4, \u003c= 2.19.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.18.2, \u003c= 2.18.9"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88A1E0DB-FA70-449D-B872-6C8051A7A8A2",
              "versionEndIncluding": "2.18.9",
              "versionStartIncluding": "2.18.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6D346F6-DF4F-4DFA-A5C8-16D620B5573C",
              "versionEndIncluding": "2.19.7",
              "versionStartIncluding": "2.19.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "57A0A4D2-47CF-4E82-85D0-504EF978279F",
              "versionEndIncluding": "2.20.9",
              "versionStartIncluding": "2.20.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "169A0D33-C7A8-4D02-A560-3F6ED2DF29D9",
              "versionEndExcluding": "2.28.6",
              "versionStartIncluding": "2.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48408418-40B9-4657-836F-37C964B9F5B5",
              "versionEndExcluding": "2.29.3",
              "versionStartIncluding": "2.29.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C475C811-04D0-48E3-B302-A6980376BEF8",
              "versionEndExcluding": "2.30.4",
              "versionStartIncluding": "2.30.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "25E84672-263F-4C99-8698-EC5BC3FF4AC3",
              "versionEndExcluding": "2.31.4",
              "versionStartIncluding": "2.31.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9E39F02-7238-4B3C-8DDD-EED01C4C9664",
              "versionEndExcluding": "2.32.7",
              "versionStartIncluding": "2.32.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BD5E589-D0F6-4C4F-8831-E9B29C842B04",
              "versionEndExcluding": "2.33.4",
              "versionStartIncluding": "2.33.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC7B6CF8-F460-4C0E-9526-E3C3BEE613EA",
              "versionEndExcluding": "2.34.5",
              "versionStartIncluding": "2.34.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation\u0027s output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6."
    }
  ],
  "id": "CVE-2026-39860",
  "lastModified": "2026-06-17T10:42:43.027",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 5.8,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39860",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-09T13:42:26.389636Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-08T21:17:00.157",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/NixOS/nix/pull/10178"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

ubuntu-cve-2026-39860

Vulnerability from osv_ubuntu

Published

2026-04-08 21:17

Modified

2026-05-20 15:27

Summary

Details

Severity

9.0 (Critical)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

8.4 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-39860	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-39860	REPORT
	https://github.com/NixOS/nix/security/advisories/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nix-bin",
            "binary_version": "2.6.0+dfsg-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "nix-setup-systemd",
            "binary_version": "2.6.0+dfsg-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "nix",
        "purl": "pkg:deb/ubuntu/nix@2.6.0+dfsg-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.10+dfsg1-1",
        "2.3.10+dfsg1-1build1",
        "2.6.0+dfsg-2",
        "2.6.0+dfsg-3",
        "2.6.0+dfsg-3ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nix-bin",
            "binary_version": "2.18.1+dfsg-1ubuntu5+esm2"
          },
          {
            "binary_name": "nix-setup-systemd",
            "binary_version": "2.18.1+dfsg-1ubuntu5+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "nix",
        "purl": "pkg:deb/ubuntu/nix@2.18.1+dfsg-1ubuntu5+esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.16.1+dfsg-3ubuntu1",
        "2.18.1+dfsg-1ubuntu1",
        "2.18.1+dfsg-1ubuntu2",
        "2.18.1+dfsg-1ubuntu4",
        "2.18.1+dfsg-1ubuntu5",
        "2.18.1+dfsg-1ubuntu5+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nix-bin",
            "binary_version": "2.26.3+dfsg-1ubuntu4"
          },
          {
            "binary_name": "nix-setup-systemd",
            "binary_version": "2.26.3+dfsg-1ubuntu4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "nix",
        "purl": "pkg:deb/ubuntu/nix@2.26.3+dfsg-1ubuntu4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.24.9+dfsg-2ubuntu2",
        "2.26.3+dfsg-1ubuntu1",
        "2.26.3+dfsg-1ubuntu2",
        "2.26.3+dfsg-1ubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "nix-bin",
            "binary_version": "2.34.3+dfsg-1"
          },
          {
            "binary_name": "nix-setup-systemd",
            "binary_version": "2.34.3+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "nix",
        "purl": "pkg:deb/ubuntu/nix@2.34.3+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.3+dfsg-1ubuntu4",
        "2.26.3+dfsg-1ubuntu5",
        "2.32.5+dfsg-1ubuntu3",
        "2.32.5+dfsg-2ubuntu1",
        "2.34.3+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation\u0027s output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.",
  "id": "UBUNTU-CVE-2026-39860",
  "modified": "2026-05-20T15:27:25Z",
  "published": "2026-04-08T21:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-39860"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39860"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-39860"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-39860 (GCVE-0-2026-39860)

FKIE_CVE-2026-39860

ubuntu-cve-2026-39860

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature