# cve.now: Nixos

The newest entries naming Nixos as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110453](https://cve.now/CVE-2026-110453.md): Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. (CVSS 4.3)
- [CVE-2026-110452](https://cve.now/CVE-2026-110452.md): The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it sh (CVSS 4.0)
- [CVE-2026-110451](https://cve.now/CVE-2026-110451.md): Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold (CVSS 4.3)
- [CVE-2026-110450](https://cve.now/CVE-2026-110450.md): Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store (CVSS 8.0)
- [CVE-2026-110449](https://cve.now/CVE-2026-110449.md): Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions bec (CVSS 7.5)
- [CVE-2026-64846](https://cve.now/CVE-2026-64846.md): Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature (CVSS 2.8)
- [CVE-2026-61828](https://cve.now/CVE-2026-61828.md): nixos/mysql : \`services.mysql\` is configured with insecure authentication by default when used with \`mysql\` or \`percona-server\` (CVSS 8.5)
- [CVE-2026-44029](https://cve.now/CVE-2026-44029.md): An issue was discovered in Nix before 2.34.7. (CVSS 5.3)
- [CVE-2026-44028](https://cve.now/CVE-2026-44028.md): An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. (CVSS 7.5)
- [CVE-2026-39860](https://cve.now/CVE-2026-39860.md): Nix sandbox escape: file write via symlink at FOD \`.tmp\` copy destination (CVSS 9.0)
- [CVE-2026-25740](https://cve.now/CVE-2026-25740.md): Privilege escalation to the \`CAP\_NET\_RAW\` capability via the \`programs.captive-browser\` NixOS module (CVSS 5.8)
- [CVE-2026-25137](https://cve.now/CVE-2026-25137.md): NixOs Odoo database and filestore publicly accessible with default odoo configuration (CVSS 9.1)
- [CVE-2026-23838](https://cve.now/CVE-2026-23838.md): Tandoor Recipes module allows SQLite database to be externally accessible with the default settings (CVSS 8.7)
- [CVE-2025-64766](https://cve.now/CVE-2025-64766.md): NixOS has hardcoded credentials in Onlyoffice module (CVSS 5.3)
- [CVE-2025-54864](https://cve.now/CVE-2025-54864.md): Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins (CVSS 6.9)
- [CVE-2025-54800](https://cve.now/CVE-2025-54800.md): Hydra persistent XSS in build metrics (CVSS 7.1)
- [CVE-2025-53819](https://cve.now/CVE-2025-53819.md): Nix's privilege dropping to build user broke for macOS (CVSS 7.9)
- [CVE-2025-52993](https://cve.now/CVE-2025-52993.md): A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the buil (CVSS 5.6)
- [CVE-2025-52992](https://cve.now/CVE-2025-52992.md): The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. (CVSS 3.2)
- [CVE-2025-52991](https://cve.now/CVE-2025-52991.md): The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. (CVSS 3.2)
- [CVE-2025-46416](https://cve.now/CVE-2025-46416.md): The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc (CVSS 2.9)
- [CVE-2025-46415](https://cve.now/CVE-2025-46415.md): A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. (CVSS 3.2)
- [CVE-2025-32435](https://cve.now/CVE-2025-32435.md): Hydra no restricted eval after nix-eval-jobs migration (CVSS 2.6)
- [CVE-2025-32438](https://cve.now/CVE-2025-32438.md): Local privilege escalation in make-initrd-ng (CVSS 8.8)
- [CVE-2024-51481](https://cve.now/CVE-2024-51481.md): Nix allows macOS sandbox escape via built-in builders (CVSS 1.0)
- [CVE-2024-47174](https://cve.now/CVE-2024-47174.md): Credential leak when credentials are used with \`\<nix/fetchurl.nix\>\` (CVSS 5.9)
- [CVE-2024-45593](https://cve.now/CVE-2024-45593.md): Nix affected by unsafe NAR unpacking (CVSS 9.1)
- [CVE-2024-45049](https://cve.now/CVE-2024-45049.md): Nix Hydra Missing authentication when triggering evaluations (CVSS 7.5)
- [CVE-2024-43378](https://cve.now/CVE-2024-43378.md): calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems (CVSS 7.8)
- [CVE-2024-38531](https://cve.now/CVE-2024-38531.md): Nix sandbox escape (CVSS 3.6)
- [CVE-2024-32657](https://cve.now/CVE-2024-32657.md): Hydra has persistent XSS vulnerability serving HTML build outputs (CVSS 4.6)
- [CVE-2024-27297](https://cve.now/CVE-2024-27297.md): Nix Corruption of fixed-output derivations (CVSS 6.3)
- [CVE-2023-36476](https://cve.now/CVE-2023-36476.md): \`calamares-nixos-extensions\` LUKS keyfile exposure (CVSS 7.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nixos
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.