# Vulnerability in Nix 2.24

**URL:** https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902
**Category:** Security
**Created:** [September 10, 2024, 10:22am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902 "2024-09-10T10:22:10Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![fricklerhandwerk](https://discourse.nixos.org/user_avatar/discourse.nixos.org/fricklerhandwerk/32/2029_2.png) [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 10, 2024, 11:00am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/2 "2024-09-10T11:00:05Z")

</div>

To summarize:

- This vulnerability allows privilege escalation, so it’s serious
- It only affects Nix 2.24.0 to 2.24.5
- The known attack vectors are closed in Nix 2.24.6

Please excuse any delay; we will publish a post mortem once the acute situation is cleaned up.

In the meantime, if you installed or upgraded Nix recently (after 2024-08-01 and before 2024-09-10):

- If you installed Nix standalone using the official installer, as found on

- If you installed Nix using [the Determinate Systems installer](https://github.com/DeterminateSystems/nix-installer), then please update to 2.24.6 by [upgrading](https://github.com/DeterminateSystems/nix-installer/tree/main?tab=readme-ov-file#upgrading-nix), or by [uninstalling](https://github.com/DeterminateSystems/nix-installer/tree/main?tab=readme-ov-file#uninstalling) and re-running the Determinate Systems installer.

- If you set [`nixVersions.git`](https://search.nixos.org/packages?show=nixVersions.git) or [`nixVersions.nix_2_24`](https://search.nixos.org/packages?channel=unstable&show=nixVersions.nix_2_24) in your NixOS, Home Manager, or `nix-darwin` configuration, update your Nixpkgs pin and rebuild the system. Otherwise you don’t need to do anything.

[Lix](https://lix.systems/) is not affected because it was forked off Nix 2.18. The vulnerability was reported by Lix core team member @puckipedia.

Mentioned elsewhere, for reference:

- [Nix 2.24+ is vulnerable to (remote) privilege escalation | Lobsters](https://discourse.nixos.org/t/nix-2-24-is-vulnerable-to-remote-privilege-escalation-lobsters/51890)
- [Determinate Status - Uncoordinated disclosure of a Nix 2.24 privilege escalation vulnerability](https://status.determinate.systems/incidents/1js0r53719f4)

---

_[View the full topic](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902)._