Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-39860

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-08 Apr, 2026 | 20:58
Updated At-09 Apr, 2026 | 13:42
Rejected At-
Credits

Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:08 Apr, 2026 | 20:58
Updated At:09 Apr, 2026 | 13:42
Rejected At:
â–¼CVE Numbering Authority (CNA)
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

Affected Products
Vendor
NixOS
Product
nix
Versions
Affected
  • >= 2.21, < 2.28.6
  • >= 2.29.0, < 2.29.3
  • >= 2.30.0, < 2.30.4
  • >= 2.31.0, < 2.31.4
  • >= 2.32.0, < 2.32.7
  • >= 2.33.0, < 2.33.4
  • >= 2.34.0, < 2.34.5
  • >= 2.20.5, <= 2.20.9
  • >= 2.19.4, <= 2.19.7
  • >= 2.18.2, <= 2.18.9
Problem Types
TypeCWE IDDescription
CWECWE-61CWE-61: UNIX Symbolic Link (Symlink) Following
Type: CWE
CWE ID: CWE-61
Description: CWE-61: UNIX Symbolic Link (Symlink) Following
Metrics
VersionBase scoreBase severityVector
3.19.0CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Version: 3.1
Base score: 9.0
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
x_refsource_CONFIRM
https://github.com/NixOS/nix/pull/10178
x_refsource_MISC
https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
x_refsource_MISC
https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
x_refsource_MISC
https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
x_refsource_MISC
https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
x_refsource_MISC
Hyperlink: https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/NixOS/nix/pull/10178
Resource:
x_refsource_MISC
Hyperlink: https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
Resource:
x_refsource_MISC
Hyperlink: https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
Resource:
x_refsource_MISC
Hyperlink: https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
Resource:
x_refsource_MISC
Hyperlink: https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
Resource:
x_refsource_MISC
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:08 Apr, 2026 | 21:17
Updated At:15 Apr, 2026 | 16:12

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.19.0CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary3.18.4HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Type: Secondary
Version: 3.1
Base score: 9.0
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Type: Primary
Version: 3.1
Base score: 8.4
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CPE Matches
nixos
nixos
>>nix>>Versions from 2.18.2(inclusive) to 2.18.9(inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.19.4(inclusive) to 2.19.7(inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.20.5(inclusive) to 2.20.9(inclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.21.0(inclusive) to 2.28.6(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.29.0(inclusive) to 2.29.3(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.30.0(inclusive) to 2.30.4(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.31.0(inclusive) to 2.31.4(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.32.0(inclusive) to 2.32.7(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.33.0(inclusive) to 2.33.4(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
nixos
nixos
>>nix>>Versions from 2.34.0(inclusive) to 2.34.5(exclusive)
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Linux Kernel Organization, Inc
linux
>>linux_kernel>>-
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-61Primarysecurity-advisories@github.com
CWE ID: CWE-61
Type: Primary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9security-advisories@github.com
Patch
https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343asecurity-advisories@github.com
Patch
https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688security-advisories@github.com
Patch
https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31asecurity-advisories@github.com
Patch
https://github.com/NixOS/nix/pull/10178security-advisories@github.com
Issue Tracking
Patch
https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gjsecurity-advisories@github.com
Mitigation
Patch
Vendor Advisory
Hyperlink: https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/NixOS/nix/pull/10178
Source: security-advisories@github.com
Resource:
Issue Tracking
Patch
Hyperlink: https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
Source: security-advisories@github.com
Resource:
Mitigation
Patch
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

6Records found
CVE-2023-22875
Matching Score-8
Assigner-IBM Corporation
ShareView Details
Matching Score-8
Assigner-IBM Corporation
CVSS Score-8.4||HIGH
EPSS-0.31% / 22.99%
||
7 Day CHG~0.00%
Published-17 Jan, 2023 | 18:22
Updated-04 Apr, 2025 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IBM Security QRadar SIEM information disclosure

IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not require that key. IBM X-Force ID: 244356.

Action-Not Available
Vendor-IBM CorporationLinux Kernel Organization, Inc
Product-qradar_security_information_and_event_managerlinux_kernelSecurity QRadar SIEM
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-1079
Matching Score-6
Assigner-Google LLC
ShareView Details
Matching Score-6
Assigner-Google LLC
CVSS Score-7.8||HIGH
EPSS-0.16% / 6.00%
||
7 Day CHG~0.00%
Published-12 May, 2025 | 20:03
Updated-29 Jul, 2025 | 13:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
RCE In Google Web Designer

Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature

Action-Not Available
Vendor-Apple Inc.Linux Kernel Organization, IncGoogle LLC
Product-web_designermacoslinux_kernelWeb Designer
CWE ID-CWE-59
Improper Link Resolution Before File Access ('Link Following')
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CVE-2024-52537
Matching Score-6
Assigner-Dell
ShareView Details
Matching Score-6
Assigner-Dell
CVSS Score-6.3||MEDIUM
EPSS-0.18% / 7.15%
||
7 Day CHG~0.00%
Published-11 Dec, 2024 | 07:26
Updated-04 Feb, 2025 | 16:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Action-Not Available
Vendor-Dell Inc.Linux Kernel Organization, IncMicrosoft Corporation
Product-windowsdock_wd19_firmware_update_utilitylinux_kerneldock_wd22tb4_firmware_update_utilitydock_hd22q_firmware_update_utilityDell Client Platform BIOS
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CWE ID-CWE-59
Improper Link Resolution Before File Access ('Link Following')
CVE-2024-0134
Matching Score-6
Assigner-NVIDIA Corporation
ShareView Details
Matching Score-6
Assigner-NVIDIA Corporation
CVSS Score-4.1||MEDIUM
EPSS-0.38% / 30.15%
||
7 Day CHG~0.00%
Published-05 Nov, 2024 | 18:37
Updated-08 Nov, 2024 | 15:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.

Action-Not Available
Vendor-NVIDIA CorporationLinux Kernel Organization, Inc
Product-nvidia_container_toolkitnvidia_gpu_operatorlinux_kernelNVIDIA GPU OperatorNVIDIA Container Toolkit
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CVE-2025-33225
Matching Score-6
Assigner-NVIDIA Corporation
ShareView Details
Matching Score-6
Assigner-NVIDIA Corporation
CVSS Score-8.4||HIGH
EPSS-0.26% / 17.90%
||
7 Day CHG~0.00%
Published-16 Dec, 2025 | 17:37
Updated-02 Feb, 2026 | 16:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names. A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.

Action-Not Available
Vendor-Linux Kernel Organization, IncNVIDIA Corporation
Product-nvidia_resiliency_extensionlinux_kernelResiliency Extension
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CVE-2024-44132
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-8.4||HIGH
EPSS-0.24% / 14.58%
||
7 Day CHG~0.00%
Published-16 Sep, 2024 | 23:23
Updated-02 Apr, 2026 | 18:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.

Action-Not Available
Vendor-Apple Inc.
Product-macosmacOSmacos
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CWE ID-CWE-59
Improper Link Resolution Before File Access ('Link Following')
Details not found