vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-52991

LOW
3.2
CVSS Score
Published: June 27, 2025 at 12:00 AM UTC
Updated: June 17, 2026 at 09:37 AM UTC
1 product affected across 1 vendorNix

Using Nix by NixOS?

Get instant alerts when new vulnerabilities affect Nix - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW3.2
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nix· Nixos
95%
v < 2.24.152.25.0 ≤ v < 2.26.42.27.0 ≤ v < 2.28.42.29.0 ≤ v < 2.29.12.25.02.27.02.29.0
Affected range stops below 2.24.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.26.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.28.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.29.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: [email protected]
https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017
Source: [email protected]
https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
Source: [email protected]
https://labs.snyk.io
Source: [email protected]
https://lix.systems/blog/2025-06-24-lix-cves/
Source: [email protected]
https://security-tracker.debian.org/tracker/CVE-2025-52991
Source: [email protected]
https://security.snyk.io/vuln/?search=CVE-2025-52991

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.2LOWmitre
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-276

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card