{"id":"CVE-2025-46416","aliases":["DEBIAN-CVE-2025-46416","EUVD-2025-19410","GHSA-33x6-8x8r-9jpw","UBUNTU-CVE-2025-46416"],"status":"published","title":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can...","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00185,"percentile":0.08197,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-282"],"published":"2025-06-27T00:00:00Z","modified":"2026-09-16T20:22:51Z","affected":[{"source":"osv","ecosystem":"Debian:11","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.2.0-4+deb11u1","1.2.0-4+deb11u2","1.2.0-4+deb11u3","1.3.0+26720.a2e4e-1","1.3.0+26756.c07b5-1","1.3.0+26756.c07b5-2","1.3.0-1","1.3.0-2","1.3.0-3","1.3.0-4","1.3.0-5","1.3.0~rc1-1","1.4.0+154709.ab1b557d8f3-1","1.4.0+154710+ab1b5-1","1.4.0+154710+ab1b5-2","1.4.0+154928+f1810-1","1.4.0-1","1.4.0-2","1.4.0-3","1.4.0-4","1.4.0-5","1.4.0-6","1.4.0-7","1.4.0-8","1.4.0-9","1.4.0~rc1-1","1.4.0~rc1-2","1.4.0~rc2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4","1.3.0-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-5","1.4.0-6","1.4.0-6build1","1.4.0-6ubuntu0.1~esm1"]}],"products":[{"vendor":"nixos","product":"nix"}],"references":[{"url":"https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017","tags":["advisory"]},{"url":"https://lix.systems/blog/2025-06-24-lix-cves/","tags":["article"]},{"url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/","tags":["article","report"]},{"url":"https://labs.snyk.io","tags":["web"]},{"url":"https://security.snyk.io/vuln/?search=CVE-2025-46416","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-46416","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46416"},{"url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025"},{"url":"https://lix.systems/blog/2025-06-24-lix-cves"},{"url":"https://github.com/advisories/GHSA-33x6-8x8r-9jpw"},{"url":"https://ubuntu.com/security/CVE-2025-46416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46416","tags":["report"]},{"url":"https://codeberg.org/guix/guix/pulls/788","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/be8aca065118aa4485c02f991c51bea89034defa","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/c659f977bb09de6d5615e6aa9efddedc1d9ff458","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/0e79d5b6550729e6ce3bac1e979638ac054ba5a5","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-46416","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T00:00:00Z","modified":"2025-06-27T15:49:08.285Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-282"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-19410","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T00:00:00Z","modified":"2025-06-27T15:49:08Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:15.785343Z"}],"ghsa":[{"id":"GHSA-33x6-8x8r-9jpw","title":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can...","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T15:31:24Z","modified":"2025-06-27T15:31:33Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-282"],"updated_at":"2026-11-02T15:02:51.078272Z"}],"nvd":[{"id":"CVE-2025-46416","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:38.163Z","modified":"2026-06-17T09:26:22.34Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-282"],"updated_at":"2026-11-02T14:11:14.781314Z"}],"osv":[{"id":"DEBIAN-CVE-2025-46416","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:38.163Z","modified":"2026-08-27T23:05:38.527286047Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-46416","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:00Z","modified":"2026-09-16T20:22:51.209326616Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CVE-2025-46416","description":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:38Z","modified":"2026-04-10T05:28:26.386534Z","updated_at":"2026-11-02T15:44:49.707645Z"}]}}