What is the CVSS score of CVE-2025-53819?

CVE-2025-53819 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-53819?

Within 24 hours: Identify all systems running Nix 2.30.0 on macOS and assess their role in your CI/CD pipeline and development workflows. Within 7 days: Implement network isolation for affected build systems and disable Nix builds on macOS 2.30.0 environments until mitigation is available. Within 30 days: Monitor for Nix 2.30.1+ release and plan immediate upgrades; conduct a build artifact integrity audit to identify any potentially compromised outputs.

macOS CVE-2025-53819

EUVD-2025-21392 HIGH

Privilege Dropping / Lowering Errors (CWE-271)

2025-07-14 security-advisories@github.com

Information Disclosure Apple macOS

7.9

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-271 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V8 - Authorization Privilege dropping
Impact	The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) indicates: (1) local attack vector requiring physical or logical access, (2) low attack complexity with no special conditions, (3) low privilege requirement (standard user can trigger), (4) high integrity impact (code execution as root), and (5) scope change affecting the system boundary. The real-world risk is substantial for macOS Nix users. The privilege escalation nature and integrity-focused impact classify this as a high-priority issue despite no current KEV listing or public POC. SSVC considerations: exploitation is likely possible (builds are user-triggerable), the impact is technical (full system compromise), and automatable exploitation is probable since any package build in Nix can serve as the attack vector. This is NOT a theoretical high-CVSS-low-risk issue—it is a genuine local privilege escalation affecting a critical system component. Organizations using Nix on macOS for development or CI/CD should prioritize patching immediately.
Exploit ScenarioDerived	A macOS developer or CI/CD system running Nix 2.30.0 initiates a package build (e.g., 'nix build' or 'nix flake check'). Normally, the build would execute under an unprivileged '_nixbld' user. Due to the vulnerability, the build process instead executes with the invoking user's privileges—or if invoked via sudo, with root privileges. A malicious package dependency or a crafted Nix expression in the build phase can execute arbitrary shell commands, including installing rootkits, modifying system files, stealing SSH/GPG keys, or compromising the entire system. Because the attack requires only a local user to trigger a build (low privilege requirement, no user interaction), an attacker could embed a malicious dependency in a package or contribute a backdoored Nix package to a public repository, affecting multiple users. The low attack complexity and lack of user interaction requirements make this a high-risk vector for development environments and supply-chain attacks targeting macOS Nix users.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

CVE-2025-53819 is a privilege escalation vulnerability in Nix 2.30.0 on macOS where package builds are incorrectly executed with root privileges instead of restricted build user accounts. This affects macOS systems running Nix 2.30.0, allowing local attackers with standard user privileges to execute arbitrary code with root-level access during package builds. The vulnerability was patched in Nix 2.30.1, and no public exploits or known workarounds are currently available, though the high CVSS score (7.9) reflects the severity of privilege escalation with potential system-wide impact.

RemediationAI

{'action': 'Upgrade Nix immediately', 'details': "Update from Nix 2.30.0 to Nix 2.30.1 or later. On macOS systems, run 'nix upgrade-nix' or reinstall via the official installer from https://nixos.org/download.html"} {'action': 'Verify patch installation', 'details': "Confirm version with 'nix --version' and ensure output shows 2.30.1 or higher"} {'action': 'No workarounds available', 'details': 'The vendor explicitly noted no known workarounds; patching is the only mitigation'} {'action': 'Review build audit logs', 'details': 'On systems that ran Nix 2.30.0, audit any packages built during the vulnerable period, as builds may have executed with elevated privileges'} {'action': 'Restrict Nix access if patching delayed', 'details': 'If immediate patching is not possible, restrict Nix invocation to trusted administrators only via file permissions and sudo rules'}

Affected VersionsENISA

nix = 2.30.0

Affected Packages

euvd nix no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Nix is a purely functional package manager that uses declarative configuration and implements multi-user build isolation through dedicated unprivileged build users. The vulnerability stems from CWE-271 (Improper Privilege Management), indicating a flaw in the privilege dropping mechanism on macOS. On Unix-like systems, Nix normally spawns builds under restricted user accounts to sandbox package builds and prevent malicious or buggy build scripts from gaining system access. The macOS implementation in version 2.30.0 failed to properly enforce this user context switching, causing build processes to execute with the invoking user's privileges (potentially root if sudo was used, or with elevated capabilities) rather than the intended unprivileged build user. This is specific to the macOS platform; Linux builds were not affected. The affected CPE scope includes nix-package-manager versions 2.30.0 on macOS systems (cpe:2.3:a:nixos:nix:2.30.0:*:*:*:*:macos:*:*).

Know when macOS gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.9 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Ubuntu MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Jul 14, 2025 - 21:15 nvd

HIGH 7.9

DescriptionGitHub Advisory

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.

Executive ViewAI

Why It Matters

CVE-2025-53819 affects Nix package manager users on macOS, where build processes execute with root privileges instead of restricted build users, creating a significant privilege escalation risk. Organizations using Nix 2.30.0 for software builds face potential compromise of build integrity and unauthorized system access, with no patch currently available.

Business Impact: High

Compensating Controls

Disable Nix builds on affected macOS systems immediately; isolate affected build infrastructure from production networks; require manual code review and verification of all build artifacts from Nix 2.30.0; restrict Nix execution to non-privileged accounts only through OS-level access controls; monitor process execution logs for privilege escalation anomalies; consider temporary substitution with alternative package managers until patch availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.