CVE-2025-52993

Description

A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Reserved 2025-06-23 | Published 2025-06-27 | Updated 2025-06-27 | Assigner mitre

Problem types

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

Default status
unaffected

Any version before 2.24.15
affected

2.25.0 before 2.26.4
affected

2.27.0 before 2.28.4
affected

2.29.0 before 2.29.1
affected

References

discourse.nixos.org/...escalations-in-nix-lix-and-guix/66017

lix.systems/blog/2025-06-24-lix-cves/

guix.gnu.org/...5/privilege-escalation-vulnerabilities-2025/

labs.snyk.io

security.snyk.io/vuln/?search=CVE-2025-52993

security-tracker.debian.org/tracker/CVE-2025-52993

cve.org (CVE-2025-52993)

nvd.nist.gov (CVE-2025-52993)

Download JSON