CVE-2025-52993 Race condition in Nix
A race condition in Nix, Lix, and Guix allows attackers to change ownership of arbitrary files to the build user, enabling privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52993?
CVE-2025-52993 is a medium-severity vulnerability in NixOS Nix, published on 27 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Weakness: CWE-362
Which versions are affected by CVE-2025-52993?
How do I fix CVE-2025-52993?
Upgrade to a fixed version.
Is CVE-2025-52993 being exploited?
There is no known exploitation of CVE-2025-52993 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-52993, GHSA-hpxm-4hff-8prf, UBUNTU-CVE-2025-52993.