What is CVE-2025-52991?

CVE-2025-52991 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Default Permissions. CVSS score: 3.2/10. Published 2025-06-27.

How severe is CVE-2025-52991?

Low severity. CVSS v3 base score is 3.2 out of 10.

Vulnerability in Nixos Nix

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing conten…

EPSS: 0.001 (24.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N.

Affected products

Nixos Nix — versions 0, 2.25.0, 2.27.0

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-gu…
lix.systems/blog/2025-06-24-lix-cves/
guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
security.snyk.io/vuln/
security-tracker.debian.org/tracker/CVE-2025-52991
labs.snyk.io

Frequently asked questions

What is CVE-2025-52991?: CVE-2025-52991 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Default Permissions. CVSS score: 3.2/10. Published 2025-06-27.
How severe is CVE-2025-52991?: Low severity. CVSS v3 base score is 3.2 out of 10.