Known vulnerabilities in nix
Vendor:
nixos.org
Software:
nix
Software CPE:
cpe:2.3:a:nixos.org:nix:*:*:*:*:*:*:*:*
Website:
https://nixos.org
Total vulnerabilities:
9
Public exploits:
0
Known exploited (KEV):
0
Highest CVSSv4 Score:
8.7
Breakdown by Severity Chart
2.35.1
2.35.0
2.34.8
2.32.8
2.31.5
2.30.5
2.29.4
2.28.7
2.34.7
2.33.6
2.33.5
2.34.6
2.34.5
2.33.4
2.32.7
2.31.4
2.30.4
2.29.3
2.28.6
2.34.4
2.34.3
2.34.2
2.34.1
2.34.0
2.32.6
2.33.3
2.33.2
2.33.1
2.31.3
2.32.5
2.33.0
2.32.4
2.32.3
2.32.2
2.32.1
2.32.0
2.31.2
2.31.1
2.30.3
2.29.2
2.28.5
2.31.0
2.30.2
2.30.1
2.30.0
2.29.1
2.29.0
2.28.4
2.28.3
2.28.2
2.28.1
2.28.0
2.27.1
2.27.0
2.26.4
2.26.3
2.26.2
2.26.1
2.26.0
2.25.5
2.25.4
2.25.3
2.25.2
2.25.1
2.25.0
2.24.15
2.24.14
2.24.13
2.24.12
2.24.11
2.24.10
2.24.9
2.24.8
2.24.7
2.24.6
2.24.5
2.24.4
2.24.3
2.24.2
2.24.1
2.24.0
2.23.4
2.23.3
2.23.2
2.23.1
2.23.0
2.22.4
2.22.3
2.22.2
2.22.1
2.22.0
2.21.5
2.21.4
2.21.3
2.21.2
2.21.1
2.21.0
2.20.9
2.20.8
2.20.7
2.20.6
2.20.5
2.20.4
2.20.3
2.20.2
2.20.1
2.20.0
2.19.7
2.19.6
2.19.5
2.19.4
2.19.3
2.19.2
2.19.1
2.19.0
2.18.9
2.18.8
2.18.7
2.18.6
2.18.5
2.18.4
2.18.3
2.18.2
2.18.1
2.18.0
2.17.2
2.17.1
2.17.0
2.16.3
2.16.2
2.16.1
2.16.0
2.15.3
2.15.2
2.15.1
2.15.0
2.14.1
2.14.0
2.13.6
2.13.5
2.13.4
2.13.3
2.13.2
2.13.1
2.13.0
2.12.1
2.12.0
2.11.1
2.11.0
2.10.3
2.10.2
2.10.1
2.10.0
2.9.2
2.9.1
2.9.0
2.8.1
2.8.0
2.7.0
2.6.1
2.6.0
2.5.1
2.5.0
2.4
2.3.18
2.3.17
2.3.16
2.3.15
2.3.14
2.3.13
2.3.12
2.3.11
2.3.10
2.3.9
2.3.6
2.3
2.2.2
2.2.1
2.2
2.1.2
2.1.1
2.1
2.0.4
2.0.3
2.0.2
2.0.1
2.0
1.11.16
1.11.15
1.11.14
1.11.13
1.11.12
1.11.11
1.11.10
1.11.9
1.11.8
1.11.7
1.11.6
1.11.5
1.11.4
1.11.3
1.11.2
1.11.1
1.11
1.10
1.9
1.8
1.7
1.6.1
1.6
1.5.3
1.5.2
1.5.1
1.5
1.4
1.3
1.2
1.1
1.0
0.16
0.15
0.14
0.13
0.12
0.11
0.10.1
0.10
0.9.2
0.9.1
0.9
0.8.1
0.8
0.7
0.6.1
0.6
0.5
0.4
0.3
0.2
0.1
2.3.8
2.3.7
2.1.3
2.3.3
2.3.2
2.3.1
2.3.5
2.3.4
Vulnerabilities (9)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU129558 - Uncontrolled Recursion |
CWE-674 | Low | 2.29.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.33.6, 2.34.7 | 04.05.2026 |
SB2026050485 |
||
| #VU129557 - Absolute Path Traversal |
CWE-36 | Low | 2.29.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.33.6, 2.34.7 | 04.05.2026 |
SB2026050485 |
||
| #VU125379 - UNIX Symbolic Link (Symlink) Following CVE-2026-39860 |
CWE-61 | Low | 2.28.6, 2.29.3, 2.30.4, 2.31.4, 2.32.7, 2.33.4, 2.34.5 | 08.04.2026 |
SB20260408103 SB2026040968 SB2026040969 and 4 more |
||
| #VU125374 - Privilege Dropping / Lowering Errors CVE-2025-53819 |
CWE-271 | Low | 2.30.1 | 08.04.2026 |
SB20260408102 |
||
| #VU113004 - Untrusted Search Path CVE-2024-38531 |
CWE-426 | Medium | 2.18.4, 2.19.5, 2.20.7, 2.21.3, 2.22.2, 2.23.1 | 16.07.2025 |
SB20250716131 SB20260408153 |
||
| #VU125378 - Execution with Unnecessary Privileges CVE-2024-51481 |
CWE-250 | Low | 2.18.9, 2.19.7, 2.20.9, 2.21.5, 2.22.4, 2.23.4, 2.24.10 | 31.10.2024 |
SB20241031112 |
||
| #VU125375 - Improper Certificate Validation CVE-2024-47174 |
CWE-295 | Medium | 2.18.8, 2.24.8 | 26.09.2024 |
SB2024092678 SB20260408153 |
||
| #VU125376 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2024-45593 |
CWE-22 | Medium | 2.24.6 | 10.09.2024 |
SB20240910157 SB20260408153 |
||
| #VU125377 - Improper Access Control CVE-2024-27297 |
CWE-284 | Low | 2.3.18, 2.18.2, 2.19.4, 2.20.5 | 07.03.2024 |
SB2024030783 SB20260408153 SB2024042257 |