Nixos vulnerabilities
33 CVEs and advisories name Nixos as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110453Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
- CVE-2026-110452The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it sh
- CVE-2026-110451Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold
- CVE-2026-110450Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store
- CVE-2026-110449Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions bec
- CVE-2026-64846Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
- CVE-2026-61828nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
- CVE-2026-44029An issue was discovered in Nix before 2.34.7.
- CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2.
- CVE-2026-39860Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
- CVE-2026-25740Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
- CVE-2026-25137NixOs Odoo database and filestore publicly accessible with default odoo configuration
- CVE-2026-23838Tandoor Recipes module allows SQLite database to be externally accessible with the default settings
- CVE-2025-64766NixOS has hardcoded credentials in Onlyoffice module
- CVE-2025-54864Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
- CVE-2025-54800Hydra persistent XSS in build metrics
- CVE-2025-53819Nix's privilege dropping to build user broke for macOS
- CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the buil
- CVE-2025-52992The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails.
- CVE-2025-52991The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location.
- CVE-2025-46416The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc
- CVE-2025-46415A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders.
- CVE-2025-32435Hydra no restricted eval after nix-eval-jobs migration
- CVE-2025-32438Local privilege escalation in make-initrd-ng
- CVE-2024-51481Nix allows macOS sandbox escape via built-in builders
- CVE-2024-47174Credential leak when credentials are used with `<nix/fetchurl.nix>`
- CVE-2024-45593Nix affected by unsafe NAR unpacking
- CVE-2024-45049Nix Hydra Missing authentication when triggering evaluations
- CVE-2024-43378calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems
- CVE-2024-38531Nix sandbox escape