NI
Product
nix
19
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 7Medium 7Low 6
Watch
Add nix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-47174 | 5.9 | Sep 26 | Credential leak when credentials are used with `<nix/fetchurl.nix>` Affected: >= 1.11, < 2.18.8; >= 2.24.0, < 2.24.8 |
| CVE-2024-27297 | 5.9 | Mar 11 | Nix is a package manager for Linux and other Unix systems Affected: before 2.3.18; 2.4 before 2.18.2; 2.19.0 before 2.19.4; 2.20.0 before 2.20.5 |
| CVE-2025-52993 | 5.6 | Jun 27 | A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*) Affected: before 2.24.15; 2.25.0 before 2.26.4; 2.27.0 before 2.28.4; 2.29.0 before 2.29.1 |
| CVE-2026-44029 | 5.3 | May 5 | An issue was discovered in Nix before 2.34.7 Affected: 2.24.7 before 2.28.7; 2.29.0 before 2.29.4; 2.30.0 before 2.30.5; 2.31.0 before 2.31.5; 2.32.0 before 2.32.8; 2.33.0 before 2.33.6; +1 more |
| CVE-2026-110453 | 4.3 | Oct 14 | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-110451 | 4.3 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
| CVE-2026-110452 | 4.0 | Oct 14 | The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership Affected: before 2.28.8; 2.29.0 before 2.30.6; 2.31.0 before 2.31.6; 2.32.0 before 2.34.9; 2.35.0 before 2.35.3 |
Showing 7