CVE-2026-110450
8.0HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-696
Impact
Local attackers can escalate privileges on the host system. They need local execution access to trigger or race a Nix or Lix store path repair operation.
Root cause
The store repair routine destroys and replaces a store path before verifying its contents, allowing an attacker to substitute malicious files.
Affected systems
Nix before 2.35.3 and Lix before 2.95.4
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Fix & remediation
Upgrade Nix to version 2.35.3 or later, or Lix to version 2.95.4 or later. If patching immediately is not possible, avoid running store repair operations on untrusted multi-user systems.
$ nix-channel --update && nix-env -iA nixpkgs.nixAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.