Description
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7);
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NixOS | Nix | 2.24.7 – < 2.28.7, 2.29.0 – < 2.29.4, 2.30.0 – < 2.30.5, 2.31.0 – < 2.31.5, 2.32.0 – < 2.32.8, 2.33.0 – < 2.33.6, 2.34.0 – < 2.34.7 | 2.28.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nix | 2.34.8+dfsg-1 | — |
| Debian 13 | nix | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nix | No fix yet | — |
| Ubuntu 26.04 LTS | nix | No fix yet | — |
| Ubuntu 25.10 | nix | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | nix | No fix yet | — |
| Ubuntu Pro 22.04 LTS | nix | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | bootc +1 | 1.14.0-0.1.1.hum1 | RHSA-2026:7046 |
| Red Hat Hardened Images 1 | chunkah | 0.4.0-1.hum1 | RHSA-2026:10208 |
| Red Hat Hardened Images 1 | ruff +1 | 0.15.11-1.hum1 | RHSA-2026:10999 |
| Red Hat Hardened Images 1 | rust +16 | 1.95.0-2.hum1 | RHSA-2026:9438 |
Advisories 4
- RHSA-2026:10999 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7046 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:9438 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:10208 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026