Description
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Published: 2026-08-20
Score: 2.8 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A time‑of‑check/time‑of‑use race in Nix’s LocalStore restore path allows a malicious derivation using the recursive‑nix experimental feature to cause the process to follow a substituted final symlink when opening a path with O_TRUNC. This enables the Nix process or nix‑daemon to create or truncate an empty file outside the build sandbox with the daemon user’s permissions, compromising file integrity but not allowing arbitrary content writes.

Affected Systems

Nix package manager from NixOS, all versions prior to 2.35.0 are affected. The fix was introduced in 2.35.0.

Risk and Exploitability

The CVSS score of 2.8 indicates low severity. EPSS is not available, suggesting a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local execution as the nix‑daemon user or influence over a build that enables the recursive‑nix feature, along with successful timing to win the race during final symlink resolution. The attack is local and constrained to the daemon’s privileges.

Generated by OpenCVE AI on August 20, 2026 at 20:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Nix to version 2.35.0 or later to eliminate the race condition and sandbox escape.
  • If an upgrade is not immediately possible, disable the recursive‑nix experimental feature to remove the vulnerability surface during builds.
  • Ensure the nix‑daemon runs with the minimal required privileges and consider tightening build sandbox configurations to limit filesystem access.

Generated by OpenCVE AI on August 20, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Nixos
Nixos nix
Vendors & Products Nixos
Nixos nix

Thu, 20 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Title Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
Weaknesses CWE-367
CWE-61
References
Metrics cvssV3_1

{'score': 2.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N'}

Subscriptions

Nixos Nix
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T19:32:22.878Z

Reserved: 2026-07-20T18:31:39.290Z

Link: CVE-2026-64846

cve-icon Vulnrichment

Updated: 2026-08-20T19:32:18.723Z

cve-icon NVD

Status : Received

Published: 2026-08-20T17:19:16.813

Modified: 2026-08-20T20:17:45.813

Link: CVE-2026-64846

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:30:05Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

  • CWE-61

    UNIX Symbolic Link (Symlink) Following