CVE-2025-54800

Katalog CVE

CVSS 6.1 · Medium EPSS 0,20%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nixos hydra. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.

Rincian

Terbit di NVD

12 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NixOS/hydra/security/advisories/GHSA-7qwg-q53v-vh99 patch · advisory vendor
• https://github.com/NixOS/hydra/commit/dea1e168f590efb27db32dbacc82b09e15f8ae4b patch