PT-2025-29514 · Nix · Nix

Grahamc · Published 2025-07-14 · Updated 2025-07-15 · CVE-2025-53819

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Nix versions prior to 2.30.1

Description: Nix, a package manager for Linux and other Unix systems, exhibited a privilege escalation issue on macOS. Builds executed with Nix 2.30.0 were performed with elevated privileges (root) instead of the intended build user privileges.

Recommendations: Update to Nix version 2.30.1 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-271

Related Identifiers

CVE-2025-53819

GHSA-QC7J-JGF3-QMHG

Affected Products

Nix

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53819.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53819 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53819 · Vendor Advisory
• https://github.com/NixOS/nix/pull/13455 · Note
• https://github.com/NixOS/nix/commit/e2ef2cfcbc83ea01308ee64c38a58707ab23dec3 · Note
• https://github.com/NixOS/nix/pull/13281 · Note
• https://github.com/NixOS/nix/security/advisories/GHSA-qc7j-jgf3-qmhg · Note
• https://twitter.com/CVEnew/status/1944863290418426072 · Twitter Post
• https://t.me/cvetracker/27821 · Telegram Post