Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: NixOS Nix 2.24.15, 2.26.4 and 2 more versions Clear all filters
TI-2025-32998 CVE-2025-52993 · GHSA-hpxm-4hff-8prf

Race condition in NixOS Nix

Priority LOW 24

A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*).

CVSS 3.1MEDIUM 5.6 Local No auth No interaction EPSS 0.00136 Published 2025-06-27 Fixed in 2.24.15, 2.26.4 +2 CWE-362
TI-2025-32997 CVE-2025-52992 · GHSA-wcw8-hffm-7w9g

Incorrect permission assignment in NixOS Nix

Priority LOW 15

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails.

CVSS 3.1LOW 3.2 Local No auth No interaction EPSS 0.00171 Published 2025-06-27 Fixed in 2.24.15, 2.26.4 +2 CWE-732
TI-2025-32996 CVE-2025-52991 · GHSA-8vh4-gppm-m3jm

Incorrect default permissions in NixOS Nix

Priority LOW 15

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location.

CVSS 3.1LOW 3.2 Local No auth No interaction EPSS 0.00171 Published 2025-06-27 Fixed in 2.24.15, 2.26.4 +2 CWE-276
TI-2025-29136 CVE-2025-46415 · GHSA-r756-7c6v-6jh7

Time-of-check time-of-use race condition in NixOS Nix

Priority MEDIUM 49

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders.

CVSS 3.1LOW 3.2 Local No auth No interaction EPSS 0.00139 Published 2025-06-27 Fixed in 2.24.15, 2.26.4 +2 CWE-367