# 'guix substitute' and 'guix pull' Vulnerabilities

DevFeed: ['guix substitute' and 'guix pull' Vulnerabilities](<https://devfeed.tech/articles/guix-substitute-and-guix-pull-vulnerabilities-34148.md>)

Original publisher: [Read original article](<https://guix.gnu.org/blog/2026/guix-substitute-pull-vulnerabilities//>)

Author: Caleb Ristvedt

Published: 2026-07-02T17:00:00Z

Content type: release

Language: en

Sources: [GNU Guix -- Blog](<https://devfeed.tech/sources/gnu-guix-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>)

Tags: [cve](<https://devfeed.tech/tags/cve.md>), [mitm](<https://devfeed.tech/tags/mitm.md>), [root](<https://devfeed.tech/tags/root.md>), [security](<https://devfeed.tech/tags/security.md>), [security-advisory](<https://devfeed.tech/tags/security-advisory.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [user](<https://devfeed.tech/tags/user.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article details several security vulnerabilities in Guix substitute and guix pull, including remote privilege escalation, remote store corruption, possible disclosure of sensitive files, and file overwrite issues. It advises users to upgrade the Guix daemon and describes a regression affecting some unprivileged users.

## Source excerpt

Several security issues (CVE IDs pending) have been identified in guix substitute , a helper utility invoked by guix-daemon , which enable a variety of harmful activities including remote privilege escalation to the build daemon user , remote store corruption , and potentially local disclosure of sensitive files accessible to the build daemon user. All systems are affected, whether or not guix-daemon is running with root privileges; the harm that can be done when guix-daemon runs without root privileges is more limited. You are strongly advised to upgrade your daemon now (see...