NIXPKGS-2026-0247
GitHub issue
published on 15 Feb 2026
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package gobusybox
- @LeSuisse accepted
- @LeSuisse published on GitHub
Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
References
Affected products
busybox
Matching in nixpkgs
pkgs.busybox
Tiny versions of common UNIX utilities in a single small executable
pkgs.busybox-sandbox-shell
Tiny versions of common UNIX utilities in a single small executable
pkgs.minimal-bootstrap.busybox-static
Tiny versions of common UNIX utilities in a single small executable
Package maintainers
-
@alyssais Alyssa Ross <hi@alyssa.is>
-
@TethysSvensson Tethys Svensson <freaken@freaken.dk>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@Artturin Artturi N <artturin@artturin.com>