PT-2025-32681 · Hydra · Hydra

Published 2025-08-12 · Updated 2025-08-12 · CVE-2025-54800

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit dea1e16

Description: Hydra, a continuous integration service for Nix based projects, is susceptible to arbitrary JavaScript code injection into its database. A malicious package can introduce this code, which is then automatically evaluated in a client's browser when a user visits the build page. This could be initiated by a third-party project during its build process.

Recommendations: Do not build untrusted packages. Do not visit the builds page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54800

GHSA-7QWG-Q53V-VH99

Affected Products

Hydra

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54800.json · Exploit
• https://github.com/NixOS/hydra/security/advisories/GHSA-7qwg-q53v-vh99 · Patch
• https://github.com/NixOS/hydra/commit/dea1e168f590efb27db32dbacc82b09e15f8ae4b · Patch
• https://osv.dev/vulnerability/CVE-2025-54800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54800 · Security Note
• https://twitter.com/CVEnew/status/1955303409340326174 · Twitter Post