CVE-2026-39860
- Source
- https://cve.org/CVERecord?id=CVE-2026-39860
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39860.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-39860
- Aliases
-
- GHSA-g3g9-5vj6-r3gj
- Downstream
- Published
- 2026-04-08T20:58:22Z
- Modified
- 2026-10-28T10:49:39Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
- Details
-
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-61" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json
- https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
- https://nvd.nist.gov/vuln/detail/CVE-2026-39860
- https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
- https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
- https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
- https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
- https://github.com/NixOS/nix/pull/10178
Affected packages
Git / github.com/nixos/nix
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nixos/nix
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast AffectedIntroducedLast AffectedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.21" }, { "fixed": "2.28.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.29.0" }, { "fixed": "2.29.3" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.30.0" }, { "fixed": "2.30.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.31.0" }, { "fixed": "2.31.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.32.0" }, { "fixed": "2.32.7" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.33.0" }, { "fixed": "2.33.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.34.0" }, { "fixed": "2.34.5" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.20.5" }, { "last_affected": "2.20.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.19.4" }, { "last_affected": "2.19.7" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.18.2" }, { "last_affected": "2.18.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "244f3eee0bbc7f11e9b383a15ed7368e2c4becc9" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "7794354a982449927ee7401cdeb573ddd16c4688" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a3163b9eabb952b4aa96e376dea95ebcca97b31a" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
2.*
2.20.5
2.20.6
2.20.7
2.20.8
2.20.9
2.29.0
2.29.1
2.29.2
2.30.0
2.30.1
2.30.2
2.30.3
2.31.0
2.31.1
2.31.2
2.31.3
2.32.0
2.32.1
2.32.2
2.32.3
2.32.4
2.32.5
2.32.6
2.33.0
2.33.1
2.33.2
2.33.3
2.34.0
2.34.1
2.34.2
2.34.3
2.34.4
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39860.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"2063626299374465200380630849117762593",
"291623743579264100604606107699315151147",
"133984245867074877584811546896355644999",
"6623783385478870228055895055553952735",
"201679549968177287501855589338107898599",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-041118d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4c85bdc05d5645a5364f7404965cfa5b33aa7d89",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"126326355178857499273348998668846923136",
"104275766255004170294472733337239728964",
"25349587669148422561071406894577910214",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-133e1604",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "122606576570583848671962297633205443827",
"length": 12750
},
"id": "CVE-2026-39860-1b5b2a69",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc",
"function": "DerivationBuilderImpl::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"291071361050387850801299275240721477709",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-333aeeb8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"2063626299374465200380630849117762593",
"152905425773243310881679193050339624624",
"112199711851469446815596443930079088061",
"65003843910651313738737833499479356667",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-3e6b6f7d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/b743f908b10aa56b88fb490de8a0d893bd2d83d5",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106621398370612145663286542066266794911",
"65046082102873717078916810040692046111",
"185384548360857425661654491614331068743"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-51709931",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9",
"target": {
"file": "src/libutil/file-system.hh"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "336472094147386673215483127048730710242",
"length": 12650
},
"id": "CVE-2026-39860-642a5c52",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc",
"function": "LocalDerivationGoal::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"182403479915898022471876891399809301435",
"320916123059364690720092023545992022974",
"162358652943689691401583250015281863314"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-6fd8b3fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"291071361050387850801299275240721477709",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-769dd732",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "270061119441510868013995832962372203947",
"length": 12960
},
"id": "CVE-2026-39860-76be4ba9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc",
"function": "LocalDerivationGoal::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46759101516354002278320402256874045844",
"184579479110725578192318611662918659231",
"64808874070694390258376245012480347875",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-799e47ef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"target": {
"file": "src/libstore/unix/build/local-derivation-goal.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"2063626299374465200380630849117762593",
"291623743579264100604606107699315151147",
"133984245867074877584811546896355644999",
"6623783385478870228055895055553952735",
"201679549968177287501855589338107898599",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-8f4c9883",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/e4491cf47709d0c944637ed886abdfb95ed1593b",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"252464563591948633371188105876371651477",
"103996778805725221165515388349753407816",
"139794500236477519308266996110378874052",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-90ff69b5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"234332866374194599405677867630108281250",
"152499951490613741912053829733432577892",
"65447574880123520443313727739217385651"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-928b8b7a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a",
"target": {
"file": "src/libutil/util.hh"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"49504855319716497018302583240760872566",
"92638058005258331149839327491178953312",
"150529367487633691835959029905590410304"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-9eff0482",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9",
"target": {
"file": "src/libutil/file-system.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "246136601764202896901490540381467004661",
"length": 13117
},
"id": "CVE-2026-39860-b488026f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc",
"function": "LocalDerivationGoal::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327647411084575448585051077683256179626",
"length": 13041
},
"id": "CVE-2026-39860-c13ffdbf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"target": {
"file": "src/libstore/unix/build/local-derivation-goal.cc",
"function": "LocalDerivationGoal::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"286843694898450275125100439506758861325",
"218962883498347050636331515280346133730",
"95060751762131960615846886170837860027",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"73697518748330707385205958640181955365",
"35173505838002839950967105773357901437",
"302425743595407699405434931962260143380",
"5570118098602152430991061782429548357",
"96375017667254279478280694425276497754",
"203444564872663379957928773958445263394",
"64545777254778964885720624597726851010",
"104127192373901942001487894490900136240",
"89217222426633412348846290610295878881"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-c1e0cfa9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/23c7a6490a829a978af1acd56d76cc2dee7f4ad6",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"201570415464081799193634308609812018210",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-d6fa4211",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "285243476015470389918454758744480074544",
"length": 12586
},
"id": "CVE-2026-39860-d71ad136",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc",
"function": "DerivationBuilderImpl::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"49504855319716497018302583240760872566",
"92638058005258331149839327491178953312",
"150529367487633691835959029905590410304"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-dd0e7ce7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a",
"target": {
"file": "src/libutil/filesystem.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "32728513409716707160094474510719159200",
"length": 12848
},
"id": "CVE-2026-39860-deab6f4e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc",
"function": "LocalDerivationGoal::registerOutputs"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"311689788603820754096509356018530923320",
"327669024368100280169113292673870505479",
"116115854176604908085259309279310505164",
"171428544167327314622826216747362343504",
"166040523171230239687845801909294165741"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-e9679594",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"182403479915898022471876891399809301435",
"320916123059364690720092023545992022974",
"15200103905479862631530868679199645753"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-f6e1df01",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"311689788603820754096509356018530923320",
"327669024368100280169113292673870505479",
"116115854176604908085259309279310505164",
"171428544167327314622826216747362343504",
"311498733207994221769470938562080902754"
],
"threshold": 0.9
},
"id": "CVE-2026-39860-f99aadaa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a",
"target": {
"file": "src/libstore/build/local-derivation-goal.cc"
}
}
]
vanir_signatures_modified
"2026-10-28T10:49:39Z"