Lix Project vulnerabilities

Products

• Lix 2

Latest Lix Project CVEs

Newest publication first

1. CVE-2026-44028 nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

   Published 2026-05-05

   High·CVSS 7.5 EPSS 0.18%

   An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overfl...

2. CVE-2020-10800 Machine-In-The-Middle in lix

   Published 2020-03-21

   High·CVSS 8.1 EPSS 1.4%

   lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.