NI
Product
nix
18
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 7Medium 6Low 5
Watch
Add nix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45593 | 8.8 | Sep 10 | Nix affected by unsafe NAR unpacking Affected: >= 2.24.0, < 2.24.6 |
| CVE-2026-39860 | 8.4 | Apr 8 | Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination Affected: >= 2.21, < 2.28.6; >= 2.29.0, < 2.29.3; >= 2.30.0, < 2.30.4; >= 2.31.0, < 2.31.4; >= 2.32.0, < 2.32.7; >= 2.33.0, < 2.33.4; +4 more |
| CVE-2026-110450 | 8.0 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2025-53819 | 7.9 | Jul 14 | Nix's privilege dropping to build user broke for macOS Affected: = 2.30.0 |
| CVE-2019-17365 | 7.8 | Oct 9 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable Affected: through 2.3 |
| CVE-2026-110449 | 7.5 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-44028 | 7.5 | May 5 | An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2 Affected: 2.24.4 before 2.28.7; 2.29.0 before 2.29.4; 2.30.0 before 2.30.5; 2.31.0 before 2.31.5; 2.32.0 before 2.32.8; 2.33.0 before 2.33.6; +1 more |
Showing 7