CVE-2025-54800 Details
Description
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.
A persistent cross-site scripting vulnerability has been identified in NixOS Hydra, a continuous integration service for Nix-based projects, in all versions prior to the patch. This issue allows a malicious package to inject arbitrary JavaScript into the Hydra database, which is then executed in the browser of anyone visiting the build page. The vulnerability arises from unvalidated data being written to the database and subsequently rendered on the build page, creating an opportunity for cross-site scripting. This flaw also affects the 'hydra-release-name' metric.
Users can update to Hydra version 'dea1e16' or later, where this vulnerability has been patched. Instructions for updating can be found in the NixOS Hydra repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nixos hydra | < 2025-08-12 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2025 | Initial Analysis | [email protected] |
| Aug 12, 2025 | New CVE Received | [email protected] |