NIXPKGS-2026-0249
GitHub issue
published on 15 Feb 2026
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package gobusybox
- @LeSuisse accepted
- @LeSuisse published on GitHub
Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
References
Affected products
busybox
Matching in nixpkgs
pkgs.busybox
Tiny versions of common UNIX utilities in a single small executable
pkgs.busybox-sandbox-shell
Tiny versions of common UNIX utilities in a single small executable
pkgs.minimal-bootstrap.busybox-static
Tiny versions of common UNIX utilities in a single small executable
Package maintainers
-
@alyssais Alyssa Ross <hi@alyssa.is>
-
@TethysSvensson Tethys Svensson <freaken@freaken.dk>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@Artturin Artturi N <artturin@artturin.com>