Fix for Nix vulnerabilities
Flox 1.18.2 updates the bundled Nix to 2.31.6, which fixes the issues in the October 2026 Nix/Lix security advisory.
On multi-user installations, which is how Flox installs by default on Linux and macOS, several of these issues can be combined to get local root privilege escalation. All Flox releases before 1.18.2 are affected. Flox 1.18.0 and 1.18.1 shipped Nix 2.31.5, and earlier releases shipped older Nix versions that are also affected.
The advisory covers:
- An integer overflow when allocating Nix lists, leading to a heap out-of-bounds write when evaluating untrusted Nix expressions.
- Unprivileged
repairoperations that could replace a legitimate store path before its contents were verified, leading to local privilege escalation. - A macOS sandbox escape that can leave builds unconfined. This only applies if you’ve set
sandbox = trueorsandbox = relaxed; the macOS default isfalse. - Improper authorization of Nix daemon clients on macOS in unsandboxed configurations, which makes the
repairissue easier to exploit. - GHSA-hf6w-2rg9-v84g / GHSA-92x5-h528-wrmw (Nix-specific)
See the Release v1.18.2 · flox/flox · GitHub for download links or Install Flox - Flox for instructions on how to install the update.