Read the docs
TI-2026-32067 Aliases CVE-2026-44029GHSA-54vc-ph3h-x39x

An issue was discovered in Nix before 2.34.7.

Priority LOW 31CWE-36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7);

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix Fixed Nix (NixOS): 2.28.7, 2.29.4, 2.30.5 +4Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NixOSNix2.24.7 to before 2.28.7; 2.29.0 to before 2.29.4; 2.30.0 to before 2.30.5; 2.31.0 to before 2.31.5; 2.32.0 to before 2.32.8; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.72.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7Patch availableCNA
  • Nix VendorNixOS Affected 2.24.7 to before 2.28.7; 2.29.0 to before 2.29.4; 2.30.0 to before 2.30.5; 2.31.0 to before 2.31.5; 2.32.0 to before 2.32.8; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.7 Fixed in 2.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*——NixOS
  • cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* Versions — — ·NixOS

Remediation

  • Fix · CNA Nix (NixOS) Fixed in 2.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7

Red Hat 4 advisories

  • RHSA-2026:10999 Released 2026-04-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3-ruff-0.15.11-1.hum1@noarch@public-hummingbird-aarch64-rpms, python3-ruff-0.15.11-1.hum1@noarch@public-hummingbird-x86_64-rpms, ruff-0.15.11-1.hum1@aarch64 +2
  • RHSA-2026:10208 Released 2026-04-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images chunkah-0.4.0-1.hum1@aarch64, chunkah-0.4.0-1.hum1@src, chunkah-0.4.0-1.hum1@x86_64
  • RHSA-2026:9438 Released 2026-04-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images rust-1.95.0-2.hum1@aarch64, rust-1.95.0-2.hum1@src, rust-1.95.0-2.hum1@x86_64 +28
Show 1 more Red Hat advisories
  • RHSA-2026:7046 Released 2026-04-08 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images bootc-1.14.0-0.1.1.hum1@aarch64, bootc-1.14.0-0.1.1.hum1@src, bootc-1.14.0-0.1.1.hum1@x86_64 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NixOS Nix 2.28.7, 2.29.4 and 5 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:10208, RHSA-2026:10999, RHSA-2026:7046, RHSA-2026:9438

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44029
  2. 2026-10-03 Alias added: GHSA-54vc-ph3h-x39x
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 3

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2024-11208 Rsync: heap buffer overflow in rsync due to improper checksum length handling CVSS 3.1CRITICAL 9.8
  • TI-2026-19201 Tandoor Recipes module allows SQLite database to be externally accessible with the default settings CVSS 4.0HIGH 8.7
  • TI-2024-11209 Rsync: info leak via uninitialized stack contents CVSS 3.1HIGH 7.5
  • TI-2024-11212 Rsync: --safe-links option bypass leads to path traversal CVSS 3.1HIGH 7.5
  • TI-2024-11211 Rsync: path traversal vulnerability in rsync CVSS 3.1HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences