Nix and Lix: Local privilege escalation via repair operation
Summary
Nix and Lix package managers allow a local user to gain root privileges through a repair operation. The daemon can delete and replace a store path before its content is verified, so an unprivileged user who can talk to the daemon may corrupt trusted store content. The flaw is relevant for multi-user installations on Linux and macOS where untrusted users can reach the Nix daemon.
Affected
- Nix: versions up to 2.35.2, 2.34.8, 2.31.5, 2.30.5 and 2.28.7; older versions must be considered affected. Unsupported branches 2.29.x, 2.32.x and 2.33.x are presumed vulnerable.
- Lix: versions up to 2.94.2 and 2.95.3; 2.93 and older are affected and no longer maintained.
- Default configuration on single-user installations is not affected according to the vendor.
Fixed in
- Nix: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8
- Lix: 2.94.3, 2.95.4, 2.96.0
- Distribution package fixes: Unknown.
Workaround
- No workaround is documented; upgrading to a fixed version is the remedy.
- Restrict which users can reach the Nix daemon, for example by removing untrusted users from the allowed users group.
- Check store ownership manually following the instructions in the vendor's GitHub Security Advisory.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild has been found.
- No public proof of concept or exploit is known.
Our recommendation
- Inventory all Nix and Lix installations (nix --version, lix --version), prioritising multi-user hosts, CI runners and shared build servers.
- Upgrade to the fixed versions listed above. For Lix 2.95.x, use the vendor's upgrade script instead of plain nix upgrade-nix, which can uninstall Lix before the new version is installed.
- Review store ownership on multi-user installations as described in the vendor advisory.
- No emergency action is required; patch in the normal cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NixOS Discourse: Security advisory for Nix and Lix, October 2026 discourse.nixos.org
- NVD record mirror (Vulners): CVE-2026-110450 vulners.com
- OSV: UBUNTU-CVE-2026-110450 osv.dev
- VulDB: 419045 vuldb.com
- LinuxSecurity: Privilege escalation in Linux build services (Nix and Lix) linuxsecurity.com
- LWN.net: Nix and Lix security coverage lwn.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:21.
Original description (NVD)
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.