What is CVE-2025-52991?

CVE-2025-52991 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Default Permissions. CVSS score: 3.2/10. Published 2025-06-27.

How severe is CVE-2025-52991?

Low severity. CVSS v3 base score is 3.2 out of 10.

Vulnerability in Nixos Nix

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

EPSS: 0.002 (4.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N.

Affected products

Nixos Nix — versions 0, 2.25.0, 2.27.0

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

Frequently asked questions

What is CVE-2025-52991?: CVE-2025-52991 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Default Permissions. CVSS score: 3.2/10. Published 2025-06-27.
How severe is CVE-2025-52991?: Low severity. CVSS v3 base score is 3.2 out of 10.