Nix before 2.35.3 and Lix before 2.95.4 allow an attacker to lift privileges by exploiting a flaw in the repair operation, which may delete a store path before it is re‑installed and verified. This can cause the system to replace a protected path with attacker‑controlled data, granting the attacker elevated permissions. The weakness corresponds to CWE-696, representing inconsistent permission assignments.

The vulnerability affects NixOS Nix releases older than 2.35.3 and Lix releases older than 2.95.4. Users running these versions are potentially vulnerable if they invoke repair operations or allow others to do so.

The CVSS score of 8 indicates a high severity, while an EPSS score of less than 1% indicates a very low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation yet. Likely attack vectors involve local users with access to repair path is not indicated by the current description.