CVE-2025-52992: Low severity Nix Nix vulnerability
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52992?
CVE-2025-52992 is considered a high-severity vulnerability that allows arbitrary processes to modify content outside of the build sandbox.
How do I fix CVE-2025-52992?
To fix CVE-2025-52992, upgrade Nix to version 2.24.15 or higher, Lix to version 2.91.2 or higher, and Guix to version 1.4.0-38.0e79d5b or higher.
Which versions of Nix are affected by CVE-2025-52992?
Nix versions before 2.24.15, 2.26.4, 2.28.4, and 2.29.1 are affected by CVE-2025-52992.
Which versions of Lix are affected by CVE-2025-52992?
Lix versions before 2.91.2, 2.92.2, and 2.93.1 are impacted by CVE-2025-52992.
Which versions of Guix are affected by CVE-2025-52992?
Guix version 1.4.0-38.0e79d5b and earlier is affected by CVE-2025-52992.