Vulnerabilities in the package managers Nix, Lix, and Guix.
Vulnerabilities have been identified in the package managers GNU Guix, Nix, and Lix, allowing code execution with the user privileges under which build tasks are run (e.g., nixbld* in Nix/Lix). This can be exploited to write data into the build environment and make alterations to the build process. The issues are present in the background processes guix-daemon and nix-daemon, used for organizing […]
