{"id":"CVE-2026-39860","summary":"Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination","details":"Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.","aliases":["GHSA-g3g9-5vj6-r3gj"],"modified":"2026-08-12T16:23:59.064216Z","published":"2026-04-08T20:58:22.979Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-61"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39860.json"},{"type":"ADVISORY","url":"https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39860"},{"type":"FIX","url":"https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9"},{"type":"FIX","url":"https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a"},{"type":"FIX","url":"https://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688"},{"type":"FIX","url":"https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31a"},{"type":"FIX","url":"https://github.com/NixOS/nix/pull/10178"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nixos/nix","events":[{"introduced":"34807c8906a61219ec2e9132c9cf0bd4d29e1d12"},{"fixed":"716dba6692c42e301a1e769e5eac02a4d6e63150"},{"introduced":"0cd1fce3c3fde7dade50b23a19d9cdea0e6e2137"},{"fixed":"ba21cb07c3da58d8706893f1fac29294ac5fff4d"},{"introduced":"812e0693022c77a3ce77b1342be1d0aef850f2d8"},{"fixed":"a8e5b27728e3b18e63c2503a83afd04031994623"},{"introduced":"ec6ba866d1a75f04a43d3ac4061a3b0277be842b"},{"fixed":"b743f908b10aa56b88fb490de8a0d893bd2d83d5"},{"introduced":"d069633b3df1db53b9724a5bb332f910d71c5daf"},{"fixed":"4c85bdc05d5645a5364f7404965cfa5b33aa7d89"},{"introduced":"231d5b41ed1b4b65f4cb875994691a4e40b150d9"},{"fixed":"e4491cf47709d0c944637ed886abdfb95ed1593b"},{"introduced":"8e6cda649a12964370addcdf68907b66661c3265"},{"fixed":"23c7a6490a829a978af1acd56d76cc2dee7f4ad6"},{"introduced":"f8170ce9f119e5e6724eb81ff1b5a2d4c0024000"},{"last_affected":"d9775222fbfa7e5d8ce1f722ea2968ff840324b4"},{"introduced":"7794354a982449927ee7401cdeb573ddd16c4688"},{"last_affected":"185a92ba6cae0a514b74c3630a6a06431b66dee1"},{"introduced":"0bd62229cd5c1b615be40ffd5597f76c0cd73828"},{"last_affected":"0f665ff6779454f2117dcc32e44380cda7f45523"}],"database_specific":{"extracted_events":[{"introduced":"2.21"},{"fixed":"2.28.6"},{"introduced":"2.29.0"},{"fixed":"2.29.3"},{"introduced":"2.30.0"},{"fixed":"2.30.4"},{"introduced":"2.31.0"},{"fixed":"2.31.4"},{"introduced":"2.32.0"},{"fixed":"2.32.7"},{"introduced":"2.33.0"},{"fixed":"2.33.4"},{"introduced":"2.34.0"},{"fixed":"2.34.5"},{"introduced":"2.20.5"},{"last_affected":"2.20.9"},{"introduced":"2.19.4"},{"last_affected":"2.19.7"},{"introduced":"2.18.2"},{"last_affected":"2.18.9"}],"source":"AFFECTED_FIELD"}}],"versions":["2.34.4","2.34.3","2.34.2","2.34.1","2.34.0","2.32.6","2.33.3","2.33.2","2.33.1","2.31.3","2.32.5","2.33.0","2.32.4","2.32.3","2.32.2","2.32.1","2.32.0","2.31.2","2.31.1","2.30.3","2.29.2","2.31.0","2.30.2","2.30.1","2.30.0","2.29.1","2.29.0","2.18.9","2.19.7","2.20.9","2.18.8","2.18.7","2.18.6","2.20.8","2.19.6","2.18.5","2.18.4","2.19.5","2.20.7","2.18.3","2.20.6","2.20.5","2.19.4","2.18.2"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:23:59Z","vanir_signatures":[{"target":{"file":"src/libstore/unix/build/linux-derivation-builder.cc"},"deprecated":false,"digest":{"line_hashes":["2063626299374465200380630849117762593","291623743579264100604606107699315151147","133984245867074877584811546896355644999","6623783385478870228055895055553952735","201679549968177287501855589338107898599","309171929066063101477499816163952630676","291282223156724060112912409044184128529","158017344536504975276033200370845199714","131391838062342834195003139713329517364","161939429858825697159724264815243263802","155573522171301534157943738387974668392","294560503809093741446425645017153239723","38862518985393161145615608773983138962","170882016617176156767273956118724755162","49643496849593763651566308952000633538","252305325652791584263981958943837722934","70950433309405264690022602610578776021","210940060775792575281003989729734390856","256452822597564786744728201047931136453","46307152543526463895404205360647979596","208452317669697976800709796802822308044","89217222426633412348846290610295878881"],"threshold":0.9},"id":"CVE-2026-39860-041118d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/4c85bdc05d5645a5364f7404965cfa5b33aa7d89"},{"deprecated":false,"digest":{"line_hashes":["126326355178857499273348998668846923136","104275766255004170294472733337239728964","25349587669148422561071406894577910214","42443708338963283293972716473556465039","39413947880646060116032345441070357896","195118087256882528454425596905055983787","186054042327589758658788730208599230028","3713436376885720526592512928069214519","316519854383325269807949792034195747018","224826825801952046736472673889200505437","285377036956704563250521294721845152473","245407403616722288910329584471205841505","334831344021749276692159133374840971582","16889618080423957903828259468811738203","259186878452926603925967019380295743088","37395931740944499883724270540184147564"],"threshold":0.9},"id":"CVE-2026-39860-133e1604","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623","target":{"file":"src/libstore/unix/build/derivation-builder.cc"}},{"digest":{"function_hash":"122606576570583848671962297633205443827","length":12750},"id":"CVE-2026-39860-1b5b2a69","signature_type":"Function","signature_version":"v1","source":"https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d","target":{"file":"src/libstore/unix/build/derivation-builder.cc","function":"DerivationBuilderImpl::registerOutputs"},"deprecated":false},{"target":{"file":"src/libstore/include/nix/store/local-store.hh"},"deprecated":false,"digest":{"line_hashes":["291071361050387850801299275240721477709","138400843036912253489790086156414538502","79815111735647461073793108818287652141"],"threshold":0.9},"id":"CVE-2026-39860-333aeeb8","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d"},{"source":"https://github.com/nixos/nix/commit/b743f908b10aa56b88fb490de8a0d893bd2d83d5","target":{"file":"src/libstore/unix/build/linux-derivation-builder.cc"},"deprecated":false,"digest":{"line_hashes":["2063626299374465200380630849117762593","152905425773243310881679193050339624624","112199711851469446815596443930079088061","65003843910651313738737833499479356667","309171929066063101477499816163952630676","291282223156724060112912409044184128529","158017344536504975276033200370845199714","131391838062342834195003139713329517364","161939429858825697159724264815243263802","155573522171301534157943738387974668392","294560503809093741446425645017153239723","38862518985393161145615608773983138962","170882016617176156767273956118724755162","49643496849593763651566308952000633538","252305325652791584263981958943837722934","70950433309405264690022602610578776021","210940060775792575281003989729734390856","256452822597564786744728201047931136453","46307152543526463895404205360647979596","208452317669697976800709796802822308044","89217222426633412348846290610295878881"],"threshold":0.9},"id":"CVE-2026-39860-3e6b6f7d","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623","target":{"file":"src/libstore/include/nix/store/local-store.hh"},"deprecated":false,"digest":{"line_hashes":["291071361050387850801299275240721477709","138400843036912253489790086156414538502","79815111735647461073793108818287652141"],"threshold":0.9},"id":"CVE-2026-39860-769dd732","signature_type":"Line"},{"source":"https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150","target":{"file":"src/libstore/unix/build/local-derivation-goal.cc"},"deprecated":false,"digest":{"line_hashes":["46759101516354002278320402256874045844","184579479110725578192318611662918659231","64808874070694390258376245012480347875","42443708338963283293972716473556465039","39413947880646060116032345441070357896","195118087256882528454425596905055983787","186054042327589758658788730208599230028","3713436376885720526592512928069214519","316519854383325269807949792034195747018","224826825801952046736472673889200505437","285377036956704563250521294721845152473","245407403616722288910329584471205841505","334831344021749276692159133374840971582","16889618080423957903828259468811738203","259186878452926603925967019380295743088","37395931740944499883724270540184147564"],"threshold":0.9},"id":"CVE-2026-39860-799e47ef","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["2063626299374465200380630849117762593","291623743579264100604606107699315151147","133984245867074877584811546896355644999","6623783385478870228055895055553952735","201679549968177287501855589338107898599","309171929066063101477499816163952630676","291282223156724060112912409044184128529","158017344536504975276033200370845199714","131391838062342834195003139713329517364","161939429858825697159724264815243263802","155573522171301534157943738387974668392","294560503809093741446425645017153239723","38862518985393161145615608773983138962","170882016617176156767273956118724755162","49643496849593763651566308952000633538","252305325652791584263981958943837722934","70950433309405264690022602610578776021","210940060775792575281003989729734390856","256452822597564786744728201047931136453","46307152543526463895404205360647979596","208452317669697976800709796802822308044","89217222426633412348846290610295878881"],"threshold":0.9},"id":"CVE-2026-39860-8f4c9883","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/e4491cf47709d0c944637ed886abdfb95ed1593b","target":{"file":"src/libstore/unix/build/linux-derivation-builder.cc"}},{"digest":{"line_hashes":["252464563591948633371188105876371651477","103996778805725221165515388349753407816","139794500236477519308266996110378874052","42443708338963283293972716473556465039","39413947880646060116032345441070357896","195118087256882528454425596905055983787","186054042327589758658788730208599230028","3713436376885720526592512928069214519","316519854383325269807949792034195747018","224826825801952046736472673889200505437","285377036956704563250521294721845152473","245407403616722288910329584471205841505","334831344021749276692159133374840971582","16889618080423957903828259468811738203","259186878452926603925967019380295743088","37395931740944499883724270540184147564"],"threshold":0.9},"id":"CVE-2026-39860-90ff69b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/ba21cb07c3da58d8706893f1fac29294ac5fff4d","target":{"file":"src/libstore/unix/build/derivation-builder.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"327647411084575448585051077683256179626","length":13041},"id":"CVE-2026-39860-c13ffdbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150","target":{"function":"LocalDerivationGoal::registerOutputs","file":"src/libstore/unix/build/local-derivation-goal.cc"}},{"digest":{"line_hashes":["286843694898450275125100439506758861325","218962883498347050636331515280346133730","95060751762131960615846886170837860027","309171929066063101477499816163952630676","291282223156724060112912409044184128529","158017344536504975276033200370845199714","131391838062342834195003139713329517364","161939429858825697159724264815243263802","155573522171301534157943738387974668392","294560503809093741446425645017153239723","73697518748330707385205958640181955365","35173505838002839950967105773357901437","302425743595407699405434931962260143380","5570118098602152430991061782429548357","96375017667254279478280694425276497754","203444564872663379957928773958445263394","64545777254778964885720624597726851010","104127192373901942001487894490900136240","89217222426633412348846290610295878881"],"threshold":0.9},"id":"CVE-2026-39860-c1e0cfa9","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/23c7a6490a829a978af1acd56d76cc2dee7f4ad6","target":{"file":"src/libstore/unix/build/linux-derivation-builder.cc"},"deprecated":false},{"id":"CVE-2026-39860-d6fa4211","signature_type":"Line","signature_version":"v1","source":"https://github.com/nixos/nix/commit/716dba6692c42e301a1e769e5eac02a4d6e63150","target":{"file":"src/libstore/include/nix/store/local-store.hh"},"deprecated":false,"digest":{"line_hashes":["201570415464081799193634308609812018210","138400843036912253489790086156414538502","79815111735647461073793108818287652141"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/nixos/nix/commit/a8e5b27728e3b18e63c2503a83afd04031994623","target":{"file":"src/libstore/unix/build/derivation-builder.cc","function":"DerivationBuilderImpl::registerOutputs"},"deprecated":false,"digest":{"length":12586,"function_hash":"285243476015470389918454758744480074544"},"id":"CVE-2026-39860-d71ad136","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39860.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"}]}