CVE-2025-53819

Published: Jul 14, 2025Modified: Jun 17, 2026Deferred

7.9

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Exploitability: 2.0 / Impact: 5.3

Source: security-advisories@github.com (Secondary)

Description

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.

Related CWEs

CWE-271

Privilege Dropping / Lowering Errors

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

References (4)

https://github.com/NixOS/nix/commit/e2ef2cfcbc83ea01308ee64c38a58707ab23dec3

Source: security-advisories@github.com

https://github.com/NixOS/nix/pull/13281

Source: security-advisories@github.com

https://github.com/NixOS/nix/pull/13455

Source: security-advisories@github.com

https://github.com/NixOS/nix/security/advisories/GHSA-qc7j-jgf3-qmhg

Source: security-advisories@github.com

Timeline

No history available yet.