{"id":"CVE-2024-36050","details":"Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.","modified":"2026-08-12T03:51:20.944941827Z","published":"2024-05-18T21:24:10.412Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36050.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345"},{"type":"ADVISORY","url":"https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/26"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36050.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36050"},{"type":"REPORT","url":"https://github.com/NixOS/nix/issues/969"},{"type":"REPORT","url":"https://github.com/NixOS/ofborg/issues/68#issuecomment-2082789441"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nixos/nix","events":[{"introduced":"0"},{"fixed":"adba2f19a02eaa74336a06a026d3c37af8020559"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.22.1"}],"source":"DESCRIPTION"}}],"versions":["2.22.0","2.2","2.0","1.11.1","1.11","1.10","1.9","1.8","1.7","1.6.1","1.6","1.5.3","1.5.2","1.5.1","1.5","1.4","1.3","1.2","1.1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36050.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}