CVE-2025-52991: nixos nix Incorrect Default Permissions
Vulnerability summary
CVE-2025-52991 is a low (CVSS 3.2) Incorrect Default Permissions vulnerability in nixos nix. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 27-06-2025PublishedVulnerability first disclosed.
- 27-06-2025Last modifiedVulnerability information updated.
Description
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated3.2LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.2LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- NVDNIST3.2LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.01 pp
From 0.16% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- guixAll versions (No fix recorded)
Nixos1 product
- nix< 2.24.15 | ≥ 2.25.0, < 2.26.4 | ≥ 2.27.0, < 2.28.4 | ≥ 2.29.0, < 2.29.1
Ubuntu1 product
- guixAll versions (No fix recorded)
3 vendors · 3 products
