Four vulnerabilities in Guix [LWN.net]

The GNU Guix project has announced three vulnerabilities in the guix substitute utility as well as a fourth that affects the guix pull and guix time-machine commands. The impact of the vulnerabilities ranges from remote privilege escalation to local disclosure of sensitive files.

The remote exploitation of guix substitute only requires that the vulnerable system attempt to download a binary substitute. Any configured substitute server, including ones discovered using guix-daemon's --discover option, can exploit this, and so can a man-in-the-middle (MITM), regardless of whether https is used in the substitute server urls.

The local exploitation of guix substitute only requires the ability to connect to guix-daemon's socket, which by default any user can do.

Separately, another security issue (CVE ID pending) was identified in guix pull and guix time-machine, which enables anyone who can control the channels file used by these commands to cause a file to be created or overwritten wherever the user running the command in question has permission to create them.

The project is recommending that all users upgrade guix and guix-daemon immediately. See the announcement for instructions, how to test for the vulnerabilities, the disclosure timeline, and more.

to post comments

You also need --no-offload if you are offloading

Posted Jul 3, 2026 17:01 UTC (Fri) by gray_-_wolf (subscriber, #131074) [Link] (1 responses)

Based on my testing, if you want to be secure during the upgrade (so you reach for --no-substitutes), beware that (in case you have offload configured) you also need to pass --no-offload. The blog post does not seems to mention this for some reason.

Also, be persistent!

Posted Jul 3, 2026 23:08 UTC (Fri) by bauermann (subscriber, #37575) [Link]

You may hit a bug when using --no-substitutes, see https://codeberg.org/guix/guix/issues/9688

The good news is that the update will succeed after a few tries (at least that was the case for me) if you keep running "guix pull --no-substitutes" again after it fails.