Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1022 _____________________________________________________________________ DATE : 14/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Nix versions prior to 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8 Lix versions prior to 2.94.3, 2.95.4, 2.96.0. ==================================================================== https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547 https://lix.systems/blog/2026-10-13-lix-cves/ _____________________________________________________________________ Security advisory for Nix and Lix - October 2026 Announcements RaitoBezarius Summary Nix and Lix are affected by a set of issues that can be combined to achieve root privilege escalation. These issues are identified as: CVE-2026-XXXXX — an unsigned integer overflow when allocating Nix lists, leading to a heap out-of-bounds write during evaluation of untrusted expressions. CVE-2026-XXXXX — unprivileged repair operations could destroy and replace a legitimate store path before its contents were verified, leading to local privilege escalation. CVE-2026-XXXXX — a Seatbelt sandbox escape on macOS: an unqualified (allow …) form could be generated when the sandbox profile crossed an internal size threshold at a missing optional path, leaving the build unconfined. This is a coordinated disclosure between the Nix and Lix projects, with the NixOS security team coordinating the MITRE paperwork. The Lix side has been in contact with the Nix team since the first report. Guix is not affected. Additionally, there are several Nix-specific issues that are fixed in this security release but do not affect Lix: GHSA-hf6w-2rg9-v84g, CVE_2026-XXXXX — a bug in the multi-user installer. The script left the store contents (not the store directory itself) owned by the invoking user and not root. GHSA-92x5-h528-wrmw, CVE_2026-XXXXX — improper authorisation of Nix daemon clients. macOS and FreeBSD unsandboxed configurations failed to reject connections from build users, exacerbating the impact of unprivileged repair exploit. Am I affected? All systems that build untrusted derivations are impacted. The list-allocation overflow affects any evaluation of untrusted Nix code: nix eval, builds, and anything else that evaluates expressions from untrusted sources. Impact of the bug in Nix depends on the particular optimisations performed by the compiler used to build Nix. The repair privilege escalation affect multi-user daemon installations where unprivileged users can talk to the daemon, on both Linux and macOS. The Seatbelt escape affects macOS only, and only when sandbox = true or sandbox = relaxed is configured. sandbox defaults to false on macOS, so installations that never opted in are not affected. The escape can be triggered deliberately, and in some configurations by accident. Nix: Installer permission issue affects fresh installations that used https://nixos.org/nix/install multi-user installation (with --daemon flag explicitly, or by default on macOS). NixOS installations are not affected. The bad ownership affects only the initial bootstrap closure, so if you have upgraded nix (via nix upgrade-nix) and performed garbage collection on the initial generation, you are likely not affected. Users are advised to check for bad ownership manually by following the instructions in the Github Security Advisory. Patches The following versions contain the fixes. Versions older than the listed ones must be considered impacted. Nix Affected versions: ≤ 2.35.2, ≤ 2.34.8, ≤ 2.31.5, ≤ 2.30.5, ≤ 2.28.7 Fixed versions: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8 Older versions are impacted to varying degrees and should be assumed vulnerable. 2.29.x, 2.32.x and 2.33.x lineages are no longer supported by the Nix team and will not receive these fixes. If you have installed Nix via https://nixos.org/nix/install, you can upgrade via: nix upgrade-nix --upgrade-nix-store-path-url https://releases.nixos.org/nix/nix-/fallback-paths.nix Where corresponds to the fixed patch version of the minor release of Nix that you currently have installed. Lix Affected versions: ≤ 2.94.2, ≤ 2.95.3 Fixed versions: 2.94.3, 2.95.4, 2.96.0 Older branches (2.93 and older) are also impacted, but are no longer maintained and will not receive fixes. Lix 2.95.4 can be upgraded with the helper script: curl -sSf -L "https://git.lix.systems/lix-project/lix/raw/tag/2.95.4/misc/upgrade-lix.sh" \ | sudo --preserve-env=PATH bash -s -- 2.95.4 Lix 2.94.3 can be upgraded with nix upgrade-nix. nixpkgs The issues have been fixed in the following nixpkgs PRs. Each PR has a progress tracker at Making sure you're not a bot! . NixOS unstable: Nix: nixVersions: 2.35.2 -> 2.35.3, 2.34.8 -> 2.34.9, 2.31.5 -> 2.31.6, 2.… by xokdvium · Pull Request #573623 · NixOS/nixpkgs · GitHub Lix: lixPackageSets.lix_2_95.lix: 2.95.3 -> 2.95.4 by RaitoBezarius · Pull Request #573613 · NixOS/nixpkgs · GitHub NixOS 26.05: Nix: nixVersions: 2.35.2 -> 2.35.3, 2.34.8 -> 2.34.9, 2.31.5 -> 2.31.6, 2.30.5 -> 2.30.6, 2.28.7 -> 2.28.8, 2.36pre20261010 -> 2.36pre20261013 by xokdvium · Pull Request #573629 · NixOS/nixpkgs · GitHub Lix: [26.05] lixPackageSets.lix_2_94.lix: 2.94.2 -> 2.94.3, lixPackageSets.lix_2_95.lix: 2.95.2 -> 2.95.4 by RaitoBezarius · Pull Request #573612 · NixOS/nixpkgs · GitHub Acknowledgement We would like to thank: References Lix: Lix | 3 security issues in Lix . Nix: libexpr `builtins.genList` overflow in list size calculation · Advisory · NixOS/nix · GitHub nix-daemon: Unprivileged clients can corrupt store paths via repair flag in AddToStoreNar/AddMultipleToStore · Advisory · NixOS/nix · GitHub Connections from build users group are not rejected by the daemon when using LOCAL_PEERCRED · Advisory · NixOS/nix · GitHub macOS seatbelt sandbox bypass via missing optional host dependencies · Advisory · NixOS/nix · GitHub Bad store ownership in multi-user scripted installer · Advisory · NixOS/nix · GitHub ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================