Vulnerability · Published Jun 27, 2025 · Assigned by mitre
CVE-2025-52991
Low 3.2
In plain English
A low-severity incorrect default permissions in Nix from NixOS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Affected products (as reported)
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017
- https://lix.systems/blog/2025-06-24-lix-cves/
- https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
- https://security.snyk.io/vuln/?search=CVE-2025-52991
- https://security-tracker.debian.org/tracker/CVE-2025-52991
- https://labs.snyk.io