CVE-2025-54800: Hydra persistent XSS in build metrics
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54800?
CVE-2025-54800 has been classified as high severity due to its potential for remote code execution via arbitrary JavaScript injection.
How do I fix CVE-2025-54800?
To mitigate CVE-2025-54800, update to a version of Hydra that is newer than commit dea1e16, which addresses the vulnerability.
What versions of Hydra are affected by CVE-2025-54800?
CVE-2025-54800 affects all versions of Hydra prior to commit dea1e16.
What is the impact of CVE-2025-54800 on user data?
CVE-2025-54800 allows a malicious package to potentially access and manipulate user data in a user's browser.
Is CVE-2025-54800 exploitable without user interaction?
Yes, CVE-2025-54800 can be exploited by a malicious package without requiring user interaction when users visit the build page.