Hi,

The following vulnerability was published for nix.

CVE-2026-64846[0]:
| Nix is a package manager for Linux and other Unix systems. Prior to
| 2.35.0, a malicious derivation executed with the recursive-nix
| experimental feature can exploit a time-of-check/time-of-use race
| involving final symlink handling in the LocalStore restore path. The
| race can cause writeFile to follow a substituted final symlink when
| opening a path with O_TRUNC instead of enforcing
| FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to
| create or truncate an empty file outside the build sandbox with the
| daemon user's permissions. The primitive does not provide arbitrary-
| content writes and requires winning the race. This issue is fixed in
| version 2.35.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-64846
https://www.cve.org/CVERecord?id=CVE-2026-64846
[1] https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f
[2] https://github.com/NixOS/nix/pull/15401
[3] https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore