CVE-2025-54800

CVE-2025-54800 describes a persistent XSS in Hydra (Nix-based CI) where a malicious package could inject arbitrary JavaScript into Hydra’s database, which then gets evaluated in a client’s browser when visiting the build page. The issue is stated as fixed by commit dea1e16; workarounds include no...

CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

PT-2025-32681 · Hydra · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit dea1e16 Description: Hydra, a continuous integration service for Nix based projects, is susceptible to arbitrary JavaScript code injection into its database. A malicious package can introduce this code, which is...

CVE-2025-53819

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

Ubuntu: Security Advisory (USN-7633-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.04 LTS / 24.04 LTS : Nix vulnerabilities (USN-7633-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7633-1 advisory. Linus Heckemann discovered that Nix did not correctly handle certain binaries. An attacker could possibly use this issue to execute arbitrary...

CVE-2025-53819

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53819 Nix's privilege dropping to build user broke for macOS

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53819 Nix's privilege dropping to build user broke for macOS

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53819

CVE-2025-53819 affects Nix (package manager). On macOS, builds using Nix 2.30.0 ran with elevated privileges (root) instead of the intended build user privileges, due to the privilege-dropping change. The issue is resolved by upgrading to Nix 2.30.1 or later; no public workarounds are documented....

CVE-2025-53819 Nix's privilege dropping to build user broke for macOS

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

USN-7633-1: Nix vulnerabilities

Linus Heckemann discovered that Nix did not correctly handle certain binaries. An attacker could possibly use this issue to execute arbitrary code. CVE-2024-38531 Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS certificates. A remote attacker could possibly use this issue ...

Nix 安全漏洞

Nix is a powerful package manager from the Nix open source. It is used for making packages. A security vulnerability exists in Nix version 2.30.0 that stems from the use of elevated privileges when building on macOS...

PT-2025-29514 · Nix · Nix

Name of the Vulnerable Software and Affected Versions: Nix versions prior to 2.30.1 Description: Nix, a package manager for Linux and other Unix systems, exhibited a privilege escalation issue on macOS. Builds executed with Nix 2.30.0 were performed with elevated privileges root instead of the...

nix-2.29.1-1.1 on GA media (moderate)

nix-2.29.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15248-1 Rating: moderate Cross-References: CVE-2025-46415 CVE-2025-52991 CVE-2025-52992 CVE-2025-52993 Affected Products: openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. Description: These are all...

OPENSUSE-SU-2025:15248-1 nix-2.29.1-1.1 on GA media

These are all security issues fixed in the nix-2.29.1-1.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the Nix, Lix, and Guix package managers lies in their lack of access control mechanisms, allowing attackers to gain read and write access to data.

The vulnerability of the Nix, Lix, and Guix package managers is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain read and write access to data...

The vulnerability of the Nix, Lix, and Guix package managers lies in the improper assignment of permissions to critical resources, allowing attackers to gain read and write access to data.

The vulnerability of the Nix, Lix, and Guix package managers is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to gain access to read and modify data...

The vulnerability of the unlinkat() function in package managers Nix, Lix, and Guix allows attackers to increase their privileges.

The vulnerability of the unlinkat function in Nix, Lix, and Guix is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the guix-daemon package manager in Nix, Lix, and Guix allows a hacker to increase their privileges.

The vulnerability of the guix-daemon package manager in Nix, Lix, and Guix is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...