What’s Vulnerable › Vulnerabilities

CVE-2024-38531: Nix sandbox escape

• Severity: low (CVSS 3.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-28 · updated 2026-06-17
• Weakness: CWE-278

Description

Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.

Affected products

• NixOS Nix: from 2.23.0, < 2.23.1; from 2.22.0, < 2.22.2; from 2.21.0, < 2.21.3; from 2.20.0, < 2.20.7; from 2.19.0, < 2.19.5; from 2.18.0, < 2.18.4

References

• https://github.com/NixOS/nix/pull/10501
• https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5
• https://github.com/NixOS/nix/pull/10501
• https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5

Get alerted when CVE-2024-38531 or the next vulnerability affects your stack