The Lix and Nix projects have jointly disclosed a set of vulnerabilities that can be used to escalate privileges to root on systems running the Lix or Nix daemons. "All systems that build untrusted derivations are affected." Releases with fixes from each project are available today. CVE IDs have not yet been requested. See the announcement for more details on the vulnerabilities.