CVE-2025-54800 Hydra persistent XSS in build metrics

High 7.1 Published 12 Aug 2025 Updated 12 Aug 2025

A malicious package can inject JavaScript into Hydra build pages, allowing attackers to execute code in visitors' browsers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-54800?

CVE-2025-54800 is a high-severity cross-site scripting vulnerability in NixOS hydra, published on 12 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.

Weakness: CWE-79

Which versions are affected by CVE-2025-54800?

It affects 1 product.

Products include Nixos Hydra.

How do I fix CVE-2025-54800?

No fix has been published for CVE-2025-54800 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-54800 being exploited?

There is no known exploitation of CVE-2025-54800 in the wild and no public exploit code.

Sources

Also known as GHSA-7qwg-q53v-vh99.