CVE catalog
CVE-2025-52993
DEBIAN-
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.14% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "guix",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"1.2.0-4",
"1.3.0-2",
"1.3.0-4",
"1.3.0-4ubuntu0.1~esm1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-52993"
},
{
"name": "guix",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"1.4.0-5",
"1.4.0-6",
"1.4.0-6build1",
"1.4.0-6ubuntu0.1~esm1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-52993"
},
{
"name": "guix",
"distro": "debian",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "11",
"versions": [
"1.2.0-4",
"1.2.0-4+deb11u1",
"1.2.0-4+deb11u2",
"1.2.0-4+deb11u3",
"1.3.0+26720.a2e4e-1",
"1.3.0+26756.c07b5-1",
"1.3.0+26756.c07b5-2",
"1.3.0-1",
"1.3.0-2",
"1.3.0-3",
"1.3.0-4",
"1.3.0-5",
"1.3.0~rc1-1",
"1.4.0+154709.ab1b557d8f3-1",
"1.4.0+154710+ab1b5-1",
"1.4.0+154710+ab1b5-2",
"1.4.0+154928+f1810-1",
"1.4.0-1",
"1.4.0-2",
"1.4.0-3",
"1.4.0-4",
"1.4.0-5",
"1.4.0-6",
"1.4.0-7",
"1.4.0-8",
"1.4.0-9",
"1.4.0~rc1-1",
"1.4.0~rc1-2",
"1.4.0~rc2-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "DEBIAN-CVE-2025-52993"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: