Root Access at Risk: Critical Nix Sandbox Escape Overwrites Sensitive System Files

A critical sandbox-escape vulnerability (CVE-2026-39860, CVSS 9.0) in the Nix package manager enables unprivileged users on multi-user Linux installations to create a malicious symlink during fixed-output derivation output registration, causing the root-run Nix daemon to follow the link and overwrite sensitive host files (e.g., /etc/shadow), allowing local privilege escalation to root; fixes for multiple 2.28–2.34 branches have been released and administrators should apply patches or restrict who can submit builds and access the daemon socket.