Skip to content

GHSA-6h4g-g5j9-fm5f

CVE Information

Impact

With the recursive-nix experimental feature enabled, a malicious derivation can exploit a TOCTOU race to get the nix process to truncate or create an empty file outside of the build sandbox as the user running the nix process (or nix-daemon).

Fix

The issue is fixed in Nix 2.35.0. Prior versions will not be receiving the fixes due to the limited impact, a prerequisite of enabling the recursive-nix experimental feature and the complexity of the fix.