CVE-2025-46415 Race condition in Nix
A race condition in Nix, Lix, and Guix allows attackers to remove content from arbitrary folders, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46415?
CVE-2025-46415 is a low-severity vulnerability in NixOS Nix, published on 27 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Weakness: CWE-367
Which versions are affected by CVE-2025-46415?
How do I fix CVE-2025-46415?
Upgrade to a fixed version.
Is CVE-2025-46415 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46415 exists.
Sources
Also known as DEBIAN-CVE-2025-46415, GHSA-r756-7c6v-6jh7, UBUNTU-CVE-2025-46415.