Loading story…
Multiple vulnerabilities in GNU Guix and guix-daemon exposed systems to arbitrary file writes and possible privilege escalation through unsafe handling of substitutes and archive restoration. The most severe issue affected the restore-file logic used by guix substitute, where a path traversal flaw could let a malicious substitute server or a man-in-the-middle attacker write files outside the intended directory; on systems where guix-daemon runs with elevated privileges, that could lead to root compromise. Reports also cited insufficient validation of narinfo metadata and unsafe processing of attacker-controlled URLs, including file:// URIs.
The weaknesses extended beyond guix substitute to other Guix operations, including guix offload, guix archive --extract, guix challenge, guix pull, and guix time-machine, creating several paths for arbitrary overwrite or local privilege escalation depending on deployment. Updated Guix releases were issued to fix the flaws, and users were urged to upgrade both Guix and guix-daemon; where immediate patching was not possible, a temporary mitigation was to disable substitutes with:
guix --no-substitutes
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A Guix pull request merged fixes four vulnerabilities: three in `guix substitute` and one in channel authentication affecting `guix pull` and `guix time-machine`. The issues included unsafe archive extraction before verification, attacker-influenced `file://` URI handling, narinfo/store-path validation failures, and a cache-file path flaw that could enable attacker-chosen writes; users were urged to update immediately.
The disclosed flaws were addressed in updated Guix releases, with guidance for users to upgrade guix and guix-daemon. As a temporary mitigation, users were also advised to disable substitutes with the "--no-substitutes" option where appropriate.
Multiple security flaws in GNU Guix and guix-daemon were disclosed affecting substitute handling and archive restoration. The most serious issue involved path traversal in restore-file logic that could enable arbitrary file writes and possible privilege escalation, especially when guix-daemon runs with elevated privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
codeberg.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourceguix.gnu.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated disclosure detailed a local privilege escalation flaw in the **Nix** and **Lix** package manager daemons that can let a local user execute arbitrary code as **root** in multi-user deployments. The primary issue, tracked as `CVE-2026-44028`, stems from unbounded recursion in the Nix Archive (**NAR**) directory parser running on a coroutine stack without a guard page, creating a stack-to-heap overflow condition that can lead to heap corruption. Exploitation requires access to the daemon interface, typically through `allowed-users` or `trusted-users`, and a crafted deeply nested NAR payload; the attack is considered most relevant where the daemon runs as root and user access is broadly permitted. Maintainers released fixes across multiple supported branches, including **Nix** `2.34.7`, `2.33.6`, `2.32.8`, `2.31.5`, `2.30.5`, `2.29.4`, and `2.28.7`, and **Lix** `2.93.4`, `2.94.2`, and `2.95.2`. The patches add recursion depth limits, guard pages for coroutine stacks, bounds checks for file names and symlink targets, and worker crash limits intended to make ASLR brute forcing harder. The disclosure also distinguished this flaw from separate Nix issues, including `CVE-2026-44029` / `GHSA-gr92-w2r5-qw5p`, and stated that **Guix is not affected**; remote substituters were described as a limited practical attack path because they cannot reliably generate enough attempts to exploit the bug.
Jun 29, 2026
CERT Polska disclosed three vulnerabilities in **GNU cpio** affecting versions through **2.15**, tracked as `CVE-2026-66484`, `CVE-2026-66485`, and `CVE-2026-66486`. The issues were reported by researchers from the **AFINE Team** and fixed in upstream commits. The most serious flaw allows **path traversal** during archive extraction, a weakness aligned with `CWE-22`, in which crafted file paths can escape the intended extraction directory and potentially overwrite or access files outside the restricted path. The additional bugs include an **uncontrolled memory allocation** issue mapped to `CWE-789` that can trigger a **stack overflow** and denial of service, and an **improper output escaping** flaw that can produce forged archive listings or inject terminal escape sequences. Together, the vulnerabilities expose users handling untrusted archives to file-system compromise, service disruption, and deceptive terminal output, underscoring the risk of insufficient pathname validation, unsafe memory handling, and unescaped archive metadata in command-line archive tools.
Aug 10, 2026
CERT Polska disclosed three vulnerabilities in **GNU cpio** affecting versions through **2.15**, tracked as `CVE-2026-66484`, `CVE-2026-66485`, and `CVE-2026-66486`. The issues were reported by researchers from the **AFINE Team** and include a **path traversal** flaw during tar extraction, an **uncontrolled memory allocation** bug that can trigger **stack overflow** and **denial of service**, and an **improper output escaping** weakness. The output-handling flaw can allow **forged archive listings** or **terminal escape-sequence injection**, creating opportunities to mislead users or manipulate terminal output. CERT Polska said the vulnerabilities have been addressed in specific upstream commits, while a separate security notice amplified the disclosure and directed users to the CERT advisory for details on the affected GNU cpio software.
Aug 10, 2026