What changed
On October 13, 2026, NixOS security coordinators and Lix maintainers disclosed three related vulnerabilities affecting Nix and Lix. One is an integer overflow in allocation of Nix evaluation lists that can produce an out-of-bounds heap write. Another lets unprivileged daemon clients invoke non-atomic store repair operations that can replace a legitimate store path before verification, opening a local privilege-escalation route. On macOS, a bug in Seatbelt sandbox-policy generation can produce an unconstrained allow rule when a missing optional path crosses a policy-size boundary. The coordinated advisory says these flaws can be combined to achieve root privilege escalation. CVE identifiers for the new October issues were not assigned at disclosure; they are distinct from earlier 2026 Nix/Lix CVEs.
Why it matters
Nix and Lix are used to make development and CI builds reproducible, including systems that evaluate third-party derivations and run multi-user build daemons. In those environments a local build user or untrusted expression may cross the boundary between isolated builds and the privileged store daemon. A package-manager update therefore changes the trustworthiness of the entire build pipeline, not just one developer workstation. Channel lag matters: a fix merged upstream does not prove the installed NixOS channel has delivered it.
Three vulnerabilities, different preconditions
The list-allocation flaw concerns evaluating untrusted expressions; the store-repair flaw matters where unprivileged users can talk to a multi-user daemon, including Linux and macOS. The Seatbelt bug affects macOS configurations with sandbox=true or sandbox=relaxed, not macOS machines with sandboxing disabled. The advisory says Guix is not affected. The Lix team did not establish a further exploit chain for the heap write by itself, while the coordinated advisory describes combined privilege-escalation risk.
Patch the exact release line, not merely the package name
The Nix advisory lists fixed versions 2.35.3, 2.34.9, 2.31.6, 2.30.6 and 2.28.8; 2.29.x, 2.32.x and 2.33.x are unsupported. Lix fixes are in 2.94.3 and 2.95.4; branches 2.93 and older are unsupported. Lix 2.96 also shipped on October 13, with further daemon and remote-store protocol changes. Operators must compare their installed binary and package/channel against the applicable fixed version.
Repair permissions and sandbox behaviour change
The fix prohibits unprivileged repair operations, so existing automated repair workflows may now need privileged intervention. The macOS fix prevents an unqualified Seatbelt allow clause from opening access beyond the intended paths. Lix 2.96 also deprecates ssh:// store URIs ahead of their removal in 2.97 in favour of ssh-ng://; this is a separate compatibility issue and should not be confused with the security patch.
NixOS channel rollouts are not instantaneous
The Lix disclosure points operators to Nixpkgs security backport pull requests for 26.05 and unstable and warns that Hydra builds and channel promotion can lag the source patch. Shared builders should check the installed version, rebuild or apply the security overlay where appropriate, and avoid evaluating untrusted expressions on exposed build hosts until remediated. There is no verified public evidence here of widespread exploitation.