{"id":"CVE-2025-52991","aliases":["DEBIAN-CVE-2025-52991","EUVD-2025-19381","GHSA-8vh4-gppm-m3jm","UBUNTU-CVE-2025-52991","openSUSE-SU-2025:15248-1"],"status":"published","title":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world...","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00171,"percentile":0.06549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-276"],"published":"2025-06-27T00:00:00Z","modified":"2026-09-16T20:22:52Z","affected":[{"source":"osv","ecosystem":"Debian:11","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.2.0-4+deb11u1","1.2.0-4+deb11u2","1.2.0-4+deb11u3","1.3.0+26720.a2e4e-1","1.3.0+26756.c07b5-1","1.3.0+26756.c07b5-2","1.3.0-1","1.3.0-2","1.3.0-3","1.3.0-4","1.3.0-5","1.3.0~rc1-1","1.4.0+154709.ab1b557d8f3-1","1.4.0+154710+ab1b5-1","1.4.0+154710+ab1b5-2","1.4.0+154928+f1810-1","1.4.0-1","1.4.0-2","1.4.0-3","1.4.0-4","1.4.0-5","1.4.0-6","1.4.0-7","1.4.0-8","1.4.0-9","1.4.0~rc1-1","1.4.0~rc1-2","1.4.0~rc2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4","1.3.0-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-5","1.4.0-6","1.4.0-6build1","1.4.0-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"nixos","product":"nix"}],"references":[{"url":"https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017","tags":["advisory"]},{"url":"https://lix.systems/blog/2025-06-24-lix-cves/","tags":["article"]},{"url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/","tags":["article","report"]},{"url":"https://security.snyk.io/vuln/?search=CVE-2025-52991","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-52991","tags":["web","advisory"]},{"url":"https://labs.snyk.io","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52991"},{"url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025"},{"url":"https://lix.systems/blog/2025-06-24-lix-cves"},{"url":"https://github.com/advisories/GHSA-8vh4-gppm-m3jm"},{"url":"https://ubuntu.com/security/CVE-2025-52991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52991","tags":["report"]},{"url":"https://codeberg.org/guix/guix/pulls/788","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/be8aca065118aa4485c02f991c51bea89034defa","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/c659f977bb09de6d5615e6aa9efddedc1d9ff458","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/0e79d5b6550729e6ce3bac1e979638ac054ba5a5","tags":["report"]},{"url":"https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52993","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-52991","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T00:00:00Z","modified":"2025-06-27T15:46:39.932Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-19381","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T00:00:00Z","modified":"2025-06-27T15:46:39Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:15.785343Z"}],"ghsa":[{"id":"GHSA-8vh4-gppm-m3jm","title":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world...","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T15:31:25Z","modified":"2025-06-27T15:31:25Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:02:51.078272Z"}],"nvd":[{"id":"CVE-2025-52991","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:41.253Z","modified":"2026-06-17T09:37:25.7Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:11:14.781314Z"}],"osv":[{"id":"DEBIAN-CVE-2025-52991","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:41.253Z","modified":"2026-08-27T23:05:40.613031462Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-52991","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:00Z","modified":"2026-09-16T20:22:52.313252394Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CVE-2025-52991","description":"The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","status":"published","published":"2025-06-27T14:15:41Z","modified":"2026-04-10T05:29:23.054617Z","updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"openSUSE-SU-2025:15248-1","title":"nix-2.29.1-1.1 on GA media","description":"These are all security issues fixed in the nix-2.29.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.726354Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}