CVE-2026-64846

{"id": "CVE-2026-64846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64846", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:32:14.918442Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "NixOS", "product": "nix", "versions": [{"status": "affected", "version": "< 2.35.0"}]}]}], "published": "2026-08-20T17:19:16.813", "references": [{"url": "https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nix/pull/15401", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-61"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0."}, {"lang": "es", "value": "Nix es un gestor de paquetes para Linux y otros sistemas Unix. Antes de la 2.35.0, una derivaci\u00f3n maliciosa ejecutada con la caracter\u00edstica experimental recursive-nix puede exploit una condici\u00f3n de carrera de tiempo de verificaci\u00f3n/tiempo de uso que involucra el manejo de symlinks finales en la ruta de restauraci\u00f3n de LocalStore. La condici\u00f3n de carrera puede hacer que writeFile siga un symlink final sustituido al abrir una ruta con O_TRUNC en lugar de aplicar FinalSymlink::DontFollow, permitiendo que el proceso Nix o nix-daemon cree o trunque un archivo vac\u00edo fuera de la sandbox de construcci\u00f3n con los permisos del usuario del demonio. La primitiva no proporciona escrituras de contenido arbitrario y requiere ganar la condici\u00f3n de carrera. Este problema est\u00e1 solucionado en la versi\u00f3n 2.35.0."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}