CVE-2025-53819: Nix Package Manager Privilege Escalation

CVE-2025-53819 Overview

CVE-2025-53819 affects Nix, a package manager for Linux and other Unix systems. On macOS, Nix 2.30.0 executed builds with elevated privileges as root instead of dropping to unprivileged build users. This privilege dropping error [CWE-271] allowed build code to run outside the intended sandboxed identity. The maintainers fixed the flaw in Nix 2.30.1. No workarounds are available for affected installations.

Critical Impact
Builds executed on macOS with Nix 2.30.0 ran as root, giving arbitrary build scripts full administrative access to the host system.

Affected Products

Nix package manager version 2.30.0 on macOS
Nix multi-user installations relying on the buildUsersGroup setting
Downstream distributions and toolchains bundling Nix 2.30.0 on macOS hosts

Discovery Timeline

2025-07-14 - CVE-2025-53819 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53819

Vulnerability Analysis

Nix supports multi-user builds where the daemon runs as root and dispatches individual build processes to unprivileged accounts in the buildUsersGroup. This isolation prevents malicious or buggy build scripts from tampering with the host. On macOS, a preprocessor condition in src/libstore/unix/user-lock.cc incorrectly combined __APPLE__ and __FreeBSD__ with a logical AND. Because no platform defines both macros simultaneously, the branch that enables build-user isolation was never compiled on macOS. Builds therefore inherited the daemon's root identity, defeating the sandbox model.

Root Cause

The root cause is a preprocessor logic error classified as an Improper Privilege Handling issue [CWE-271]. The guard #elif defined(__APPLE__) && defined(__FreeBSD__) should have used a logical OR. As a result, useBuildUsers() returned a default value that skipped the setuid-style descent to a build user before executing derivation code.

Attack Vector

Exploitation requires a local, authenticated user who can submit or trigger a Nix build on an affected macOS host. Any derivation the attacker controls, including flakes fetched from remote sources, executes with root privileges during the build phase. This yields full read and write access to the file system, the ability to modify system binaries, and persistence opportunities. Attack complexity is low and no user interaction is required.

text

     #ifdef __linux__
     static bool b = (settings.buildUsersGroup != "" || settings.autoAllocateUids) && isRootUser();
     return b;
-    #elif defined(__APPLE__) && defined(__FreeBSD__)
+    #elif defined(__APPLE__) || defined(__FreeBSD__)
     static bool b = settings.buildUsersGroup != "" && isRootUser();
     return b;
     #else

Source: NixOS/nix commit e2ef2cf

Detection Methods for CVE-2025-53819

Indicators of Compromise

Build processes spawned by nix-daemon running with uid=0 on macOS instead of a _nixbld* account
Files created inside /nix/store owned by root rather than by a member of the nixbld group
Unexpected modifications to system paths outside /nix/store correlated with recent Nix build activity

Detection Strategies

Query the installed Nix version with nix --version and flag any macOS host reporting 2.30.0
Audit process trees under nix-daemon for child processes executing derivation builders as root
Compare ownership of recent store paths against expected _nixbld* accounts using ls -l /nix/store

Monitoring Recommendations

Ingest endpoint process telemetry from macOS build hosts into your SIEM and alert on nix-daemon children with effective UID 0
Track package manager version inventory continuously and treat downgrade or pinning to 2.30.0 as a policy violation
Correlate file integrity monitoring events outside /nix/store with concurrent Nix build activity

How to Mitigate CVE-2025-53819

Immediate Actions Required

Upgrade all macOS hosts running Nix 2.30.0 to Nix 2.30.1 or later
Rebuild any artifacts produced on Nix 2.30.0 macOS hosts from trusted sources after upgrading
Review shell history, launch daemons, and system paths on affected hosts for unauthorized changes made during vulnerable builds

Patch Information

The fix landed in Nix 2.30.1 through GitHub Pull Request #13281 and Pull Request #13455. See the GitHub Security Advisory GHSA-qc7j-jgf3-qmhg for maintainer guidance. Install the patched release using the official Nix installer or your platform's package channel.

Workarounds

No workarounds are available. Upgrading to Nix 2.30.1 or later is the only supported remediation.
Restrict the ability to submit Nix builds on macOS hosts until the upgrade is complete

bash

# Verify installed version and upgrade on macOS
nix --version
# Expected output must be 2.30.1 or later
sh <(curl -L https://nixos.org/nix/install) --daemon
sudo launchctl kickstart -k system/org.nixos.nix-daemon