CVE-2026-39860
- Source
- https://cve.org/CVERecord?id=CVE-2026-39860
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39860.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-39860
- Aliases
-
- GHSA-g3g9-5vj6-r3gj
- Downstream
- Published
- 2026-04-08T20:58:22.979Z
- Modified
- 2026-08-12T16:23:59.064216Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
- Details
-
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json", "cwe_ids": [ "CWE-61" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json
- https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
- https://nvd.nist.gov/vuln/detail/CVE-2026-39860
- https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9
- https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a
- https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688
- https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a
- https://github.com/NixOS/nix/pull/10178
Affected packages
Git / github.com/nixos/nix
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nixos/nix
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast affectedIntroducedLast affectedIntroducedLast affected
- Database specific
-
Show details
{ "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "2.21" }, { "fixed": "2.28.6" }, { "introduced": "2.29.0" }, { "fixed": "2.29.3" }, { "introduced": "2.30.0" }, { "fixed": "2.30.4" }, { "introduced": "2.31.0" }, { "fixed": "2.31.4" }, { "introduced": "2.32.0" }, { "fixed": "2.32.7" }, { "introduced": "2.33.0" }, { "fixed": "2.33.4" }, { "introduced": "2.34.0" }, { "fixed": "2.34.5" }, { "introduced": "2.20.5" }, { "last_affected": "2.20.9" }, { "introduced": "2.19.4" }, { "last_affected": "2.19.7" }, { "introduced": "2.18.2" }, { "last_affected": "2.18.9" } ] }
Affected versions
2.*
2.18.2
2.18.3
2.18.4
2.18.5
2.18.6
2.18.7
2.18.8
2.18.9
2.19.4
2.19.5
2.19.6
2.19.7
2.20.5
2.20.6
2.20.7
2.20.8
2.20.9
2.29.0
2.29.1
2.29.2
2.30.0
2.30.1
2.30.2
2.30.3
2.31.0
2.31.1
2.31.2
2.31.3
2.32.0
2.32.1
2.32.2
2.32.3
2.32.4
2.32.5
2.32.6
2.33.0
2.33.1
2.33.2
2.33.3
2.34.0
2.34.1
2.34.2
2.34.3
2.34.4
Database specific
vanir_signatures
[
{
"id": "CVE-2026-39860-041118d1",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"2063626299374465200380630849117762593",
"291623743579264100604606107699315151147",
"133984245867074877584811546896355644999",
"6623783385478870228055895055553952735",
"201679549968177287501855589338107898599",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/4c85bdc05d5645a5364f7404965cfa5b33aa7d89",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-133e1604",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"126326355178857499273348998668846923136",
"104275766255004170294472733337239728964",
"25349587669148422561071406894577910214",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-1b5b2a69",
"target": {
"function": "DerivationBuilderImpl::registerOutputs",
"file": "src/libstore/unix/build/derivation-builder.cc"
},
"deprecated": false,
"digest": {
"function_hash": "122606576570583848671962297633205443827",
"length": 12750.0
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"signature_type": "Function"
},
{
"id": "CVE-2026-39860-333aeeb8",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"291071361050387850801299275240721477709",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-3e6b6f7d",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"2063626299374465200380630849117762593",
"152905425773243310881679193050339624624",
"112199711851469446815596443930079088061",
"65003843910651313738737833499479356667",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/b743f908b10aa56b88fb490de8a0d893bd2d83d5",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-769dd732",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"291071361050387850801299275240721477709",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-799e47ef",
"target": {
"file": "src/libstore/unix/build/local-derivation-goal.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"46759101516354002278320402256874045844",
"184579479110725578192318611662918659231",
"64808874070694390258376245012480347875",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-8f4c9883",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"2063626299374465200380630849117762593",
"291623743579264100604606107699315151147",
"133984245867074877584811546896355644999",
"6623783385478870228055895055553952735",
"201679549968177287501855589338107898599",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"38862518985393161145615608773983138962",
"170882016617176156767273956118724755162",
"49643496849593763651566308952000633538",
"252305325652791584263981958943837722934",
"70950433309405264690022602610578776021",
"210940060775792575281003989729734390856",
"256452822597564786744728201047931136453",
"46307152543526463895404205360647979596",
"208452317669697976800709796802822308044",
"89217222426633412348846290610295878881"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/e4491cf47709d0c944637ed886abdfb95ed1593b",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-90ff69b5",
"target": {
"file": "src/libstore/unix/build/derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"252464563591948633371188105876371651477",
"103996778805725221165515388349753407816",
"139794500236477519308266996110378874052",
"42443708338963283293972716473556465039",
"39413947880646060116032345441070357896",
"195118087256882528454425596905055983787",
"186054042327589758658788730208599230028",
"3713436376885720526592512928069214519",
"316519854383325269807949792034195747018",
"224826825801952046736472673889200505437",
"285377036956704563250521294721845152473",
"245407403616722288910329584471205841505",
"334831344021749276692159133374840971582",
"16889618080423957903828259468811738203",
"259186878452926603925967019380295743088",
"37395931740944499883724270540184147564"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-c13ffdbf",
"target": {
"function": "LocalDerivationGoal::registerOutputs",
"file": "src/libstore/unix/build/local-derivation-goal.cc"
},
"deprecated": false,
"digest": {
"function_hash": "327647411084575448585051077683256179626",
"length": 13041.0
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"signature_type": "Function"
},
{
"id": "CVE-2026-39860-c1e0cfa9",
"target": {
"file": "src/libstore/unix/build/linux-derivation-builder.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"286843694898450275125100439506758861325",
"218962883498347050636331515280346133730",
"95060751762131960615846886170837860027",
"309171929066063101477499816163952630676",
"291282223156724060112912409044184128529",
"158017344536504975276033200370845199714",
"131391838062342834195003139713329517364",
"161939429858825697159724264815243263802",
"155573522171301534157943738387974668392",
"294560503809093741446425645017153239723",
"73697518748330707385205958640181955365",
"35173505838002839950967105773357901437",
"302425743595407699405434931962260143380",
"5570118098602152430991061782429548357",
"96375017667254279478280694425276497754",
"203444564872663379957928773958445263394",
"64545777254778964885720624597726851010",
"104127192373901942001487894490900136240",
"89217222426633412348846290610295878881"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/23c7a6490a829a978af1acd56d76cc2dee7f4ad6",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-d6fa4211",
"target": {
"file": "src/libstore/include/nix/store/local-store.hh"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"201570415464081799193634308609812018210",
"138400843036912253489790086156414538502",
"79815111735647461073793108818287652141"
]
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150",
"signature_type": "Line"
},
{
"id": "CVE-2026-39860-d71ad136",
"target": {
"function": "DerivationBuilderImpl::registerOutputs",
"file": "src/libstore/unix/build/derivation-builder.cc"
},
"deprecated": false,
"digest": {
"function_hash": "285243476015470389918454758744480074544",
"length": 12586.0
},
"signature_version": "v1",
"source": "https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623",
"signature_type": "Function"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39860.json"
vanir_signatures_modified
"2026-08-12T16:23:59Z"