Back to Database
Status published
Critical
CVE-2024-45593
Nix affected by unsafe NAR unpacking
Vulnerability Description
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45593
Credits & Attribution
No credits recorded in the NVD database.
References
More from NixOS
View All →CVE-2025-64766
NixOS has hardcoded credentials in Onlyoffice module
Medium
5.3
CVE-2025-54864
Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
Medium
6.9
CVE-2025-54800
Hydra persistent XSS in build metrics
High
7.1
CVE-2025-53819
Nix's privilege dropping to build user broke for macOS
High
7.9
CVE-2025-52993
A race condition in the Nix, Lix, and Guix package...
Medium
5.6
Affected Vendor
NixOS
View all reports →Affected Software
nix
Vulnerable Versions:
>= 2.24.0, < 2.24.6
Timeline
Official Publish:
September 10th, 2024
Last Modified:
September 10th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H