Privilege Escalation Vulnerability in Nix and Lix Software
CVE-2026-110450

8HIGH

Key Information:

Vendor

Nixos

Status
Nix
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110450?

A vulnerability exists in Nix and Lix which allows an attacker to perform privilege escalation through a repair operation. This flaw can potentially allow the attacker to destroy and replace a store path without proper content verification, leading to unauthorized access and manipulation of system resources. It is crucial for users of Nix versions before 2.35.3 and Lix versions before 2.95.4 to upgrade to the latest versions to mitigate this risk.

Affected Version(s)

Nix 0 < 2.28.8

Nix 2.29.0 < 2.30.6

Nix 2.31.0 < 2.31.6

References

https://discourse.nixos.org/t/security-advisory-for-nix-a...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.