Medium severity4.3OSV Advisory· Published May 18, 2024· Updated Apr 15, 2026

CVE-2024-36050

Description

Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nixos/NixOSV2 versions
1.0, 1.1, 1.10, …+ 1 more
- (no CPE)range: 1.0, 1.1, 1.10, …
- (no CPE)range: <=2.22.1

Patches

Vulnerability mechanics

References

discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345nvd
discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/26nvd
github.com/NixOS/nix/issues/969nvd
github.com/NixOS/ofborg/issues/68nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000