CVE-2025-52992

Description

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Reserved 2025-06-23 | Published 2025-06-27 | Updated 2025-06-27 | Assigner mitre

Problem types

CWE-732 Incorrect Permission Assignment for Critical Resource

Product status

Default status
unaffected

Any version before 2.24.15
affected

2.25.0 before 2.26.4
affected

2.27.0 before 2.28.4
affected

2.29.0 before 2.29.1
affected

References

discourse.nixos.org/...escalations-in-nix-lix-and-guix/66017

lix.systems/blog/2025-06-24-lix-cves/

guix.gnu.org/...5/privilege-escalation-vulnerabilities-2025/

labs.snyk.io

security.snyk.io/vuln/?search=CVE-2025-52992

security-tracker.debian.org/tracker/CVE-2025-52992

cve.org (CVE-2025-52992)

nvd.nist.gov (CVE-2025-52992)

Download JSON