High severity · published Jul 14, 2025
CVE-2025-53819
Nix's privilege dropping to build user broke for macOS
7.9
CVSS
0.1%
EPSS
No
On KEV
Description
Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
nix · NixOS
= 2.30.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53819
github.com
https://github.com/NixOS/nix/commit/e2ef2cfcbc83ea01308ee64c38a58707ab23dec3
github.com
https://github.com/NixOS/nix/pull/13281
github.com
https://github.com/NixOS/nix/pull/13455
github.com
https://github.com/NixOS/nix/security/advisories/GHSA-qc7j-jgf3-qmhg
More from nix
8.8
CVE-2024-45593
Nix affected by unsafe NAR unpacking
8.4
CVE-2026-39860
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
8.0
CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification
7.8
CVE-2019-17365
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable
7.5
CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled