{"id":182448,"date":"2026-07-03T22:53:39","date_gmt":"2026-07-03T20:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme"},"modified":"2026-07-03T22:53:39","modified_gmt":"2026-07-03T20:53:39","slug":"uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","title":{"rendered":"A vulnerability in the Guix package manager allows for remote code execution on the system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vulnerabilities have been identified in the Guix package manager (CVE not assigned) within the implementation of the internal command «guix substitute», which is automatically invoked by the background process guix-daemon during package installation operations. This command is used to download pre-built binary packages from external servers while verifying their integrity using a digital signature. The most critical vulnerability allows remote code execution on the user's system with the privileges under which the guix-daemon background process runs. <\/p>\n

The issue affects all configurations with the guix-daemon process, regardless of whether it is run with root privileges or under an unprivileged user. To exploit the vulnerability, any attempt to download pre-compiled binary packages from server<\/a>, controlled by the attacker, is sufficient. The malicious server<\/a> It does not necessarily have to be explicitly selected or specified in the user settings — it can be determined using the «—discover» option, which allows server substitution during a MITM attack. In configurations where guix-daemon is running with elevated privileges, a local user can conduct an attack if they can connect to the background process via a Unix socket (by default available to all users). <\/p>\n

The vulnerability exists in the «restore-file» handler, used for unpacking during package loading, without waiting for the complete download and verification of the downloaded archive using a digital signature. The problem arises from the lack of checks for the presence of «.», «\\\/», and «..» characters in the file paths that are placed in the archive. By substituting incorrect file names in the archive, an attacker can achieve arbitrary file writing to any area of the file system, as permitted by the privileges under which the guix-daemon background process is running. <\/p>\n

To execute their code in the system, for example, an auto-starting script such as «~\/.bashrc» or ~\/.profile can be added, or the file ~\/.ssh\/authorized_keys with SSH keys can be modified. If guix-daemon is running under the root user in a multi-user system, an attacker can overwrite the password file or system scripts. <\/p>\n

The potential for creating rogue servers to distribute malicious packages arose because the metadata loading procedure (narinfo) for available binary packages (fetch-narinfos) did not perform server certificate verification, relying instead on the fact that most of the metadata is signed with a digital signature. It turned out that the signature did not cover the URL for downloading the package, allowing it to be substituted without compromising the integrity of the metadata. Ultimately, the rogue package would be discarded due to failing the content check against the hash signed with the digital signature, but this check occurred after the unpacking stage, where issues with special characters in file names manifested. <\/p>\n

In addition to the command «guix substitute», the vulnerable handler «restore-file» is involved in the operations of the commands «guix offload», «guix archive —extract», and «guix challenge», through which the vulnerability can also be exploited. As a workaround to block the vulnerability, it is suggested to explicitly specify the «—no-substitutes» option in all guix commands. The vulnerability fix has been incorporated into the Guix codebase. Users are recommended to promptly install the updates provided by the developers for guix and guix-daemon. <\/p>\n

Besides the identified issue in Guix, three other vulnerabilities have been addressed: <\/p>\n