Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nixos/nix
master @ 0e3b93f
110
Fixes
5
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Path Traversal: 29 prior fixes. Scrutinize any change in this area.
src/libstore/build.cc: most-fixed (15 issues). Treat as high-risk during review.
44 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Unpacking untrusted NAR and archive files can lead to directory traversal or symlink-following outside of the target store path, which could overwrite arbitrary files during unpack operations. Exploitation can lead to local root compromises.
Sandbox Escape: Failure to isolate fixed-output derivation environments completely can result in leaked file descriptors or abstract UNIX socket communication, allowing builds to escape sandbox namespaces and alter store paths.
Privilege Escalation: Performing owner modifications and chmod permissions on build outputs without validating that the files are exclusively owned by the build user allows malicious builders to hijack arbitrary host files using hard links.