# Security Advisory: Privilege Escalations in Nix, Lix and Guix
**URL:** https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017
**Category:** Security
**Created:** [June 24, 2025, 2:55pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017 "2025-06-24T14:55:59Z")
**Posts on this page:** 7
**Page:** 3
### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [June 29, 2025, 9:05pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/43 "2025-06-29T21:05:19Z")
6 posts were merged into an existing topic: [Critical correctness bug in Lix](https://discourse.nixos.org/t/critical-correctness-bug-in-lix/66182/6)
---
### Author:  [@torgeir](https://discourse.nixos.org/u/torgeir)
#### Post date: [June 29, 2025, 5:41pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/44 "2025-06-29T17:41:33Z")
Would this be enough to verify that one is up-to-date with the latest fixes? I’m on nix darwin 24.11.
```auto
> nix --version
# nix (Nix) 2.24.14
```
```auto
> EDITOR=cat nix edit nixpkgs\#nix | \
grep -C3 patches/ghsa-g948-229j-48j3-2.24.patch
# nix_2_24 = commonAutoconf {
# version = "2.24.14";
# hash = "sha256-SthMCsj6POjawLnJq9+lj/UzObX9skaeN1UGmMZiwTY=";
# patches = [./patches/ghsa-g948-229j-48j3-2.24.patch];
# self_attribute_name = "nix_2_24";
# };
```
---
### Author:  [@vcunat](https://discourse.nixos.org/u/vcunat)
#### Post date: [June 30, 2025, 7:41am UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/45 "2025-06-30T07:41:51Z")
Version updates were merged like a day afterwards, too.
---
### Author:  [@hustlerone](https://discourse.nixos.org/u/hustlerone)
#### Post date: [June 30, 2025, 9:21pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/46 "2025-06-30T21:21:21Z")
This post was flagged by the community and is temporarily hidden.
---
### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [June 30, 2025, 9:32pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/47 "2025-06-30T21:32:30Z")
That’s not very concrete. File an issue if anything is broken or temporarily remove the reason it prevents you from upgrading.
---
### Author:  [@tgerbet](https://discourse.nixos.org/u/tgerbet)
#### Post date: [July 15, 2025, 1:52pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/48 "2025-07-15T13:52:26Z")
Rory McNamara from the Snyk Security Labs team, the initial reporter of these issues, has published a blog post for those of you who enjoy technical reading: [NixOS: Declarative Management, Imperative Privilege Escalation - Deep Dive with Snyk Labs | Snyk Labs](https://labs.snyk.io/resources/nixos-deep-dive/)
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [July 15, 2025, 11:02pm UTC](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/49 "2025-07-15T23:02:41Z")
No, you have to also assert that your `nixpkgs` is pinned and that the deployed nix matches up with that input.
A quick and easy way to confirm that is to check if the `result` symlink `nix build nixpkgs#nix` produces matches up with the top-level directory of the package the `nix` binary in `$PATH` is in (or some cool `nix eval` command I can’t think of).
You have to both ensure this _and_ that the patch is added (as you did) to confirm the running nix has the patch.
[Previous page](https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017.md?page=2)