Privilege Escalation Vulnerabilities in Nix, Lix, and Guix Package Managers

CVE-2025-52991

What is CVE-2025-52991?

The Nix, Lix, and Guix package managers have a design flaw due to their use of default temporary build directories placed in world-readable and world-writable locations. This flaw allows standard users to misguide the package managers into utilizing directories that may contain pre-existing content, potentially leading to unauthorized actions and manipulation of data. This vulnerability affects multiple versions of Nix, Lix, and Guix and poses a significant risk if not addressed.

References