CVE-2025-54800: Nixos Hydra XSS Vulnerability

CVE-2025-54800 Overview

CVE-2025-54800 is a stored cross-site scripting (XSS) vulnerability in Hydra, the continuous integration service for Nix-based projects maintained by NixOS. A malicious package can inject arbitrary JavaScript into the Hydra database during its build process. That script is then evaluated in the browser of any user who visits the affected build page. The same class of injection also affects other rendering paths such as hydra-release-name. The issue is fixed in commit dea1e16.

Critical Impact
Third-party projects can execute attacker-controlled JavaScript in the browsers of Hydra users viewing build pages, enabling session theft, credential capture, and pivoting into CI infrastructure.

Affected Products

NixOS Hydra prior to commit dea1e168f590efb27db32dbacc82b09e15f8ae4b
Hydra build result rendering in src/hydra-queue-runner/build-result.cc
Hydra web templates in src/root/all.tt and related pages

Discovery Timeline

2025-08-12 - CVE-2025-54800 published to NVD
2025-08-12 - NixOS publishes security advisory GHSA-7qwg-q53v-vh99 and fix commit dea1e16
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54800

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. Hydra parses build product metadata produced during a Nix build and persists it in the Hydra database. When the web UI renders that metadata on build pages, values are inserted into HTML templates without adequate escaping. An attacker who controls a package build can therefore inject <script> payloads, arbitrary HTML, or event-handler attributes that execute when another user views the build results.

Because CI dashboards are typically viewed by maintainers and administrators, executed script runs in a privileged browser context. Attackers can steal session cookies, issue authenticated Hydra API calls, tamper with jobsets, or use the compromised session to poison downstream build artifacts.

Root Cause

Two defects combine to produce the vulnerability. First, the regular expression that parses build product declarations in src/hydra-queue-runner/build-result.cc accepts characters such as <, >, and quotes inside the path and entry-point fields. Second, template rendering in src/root/all.tt and related templates emits values like total directly into HTML without applying HTML.escape. Together, these allow HTML metacharacters to travel from a build artifact into the DOM verbatim.

Attack Vector

A third-party project submitted to a Hydra instance emits crafted build product lines during its build. The queue runner parses those lines and stores the malicious values. When any user, including maintainers, opens the builds page, the browser evaluates the injected JavaScript in the origin of the Hydra server. Exploitation requires user interaction to visit the page but no authentication on the attacker's part.

text

// Fix in src/hydra-queue-runner/build-result.cc
         "[[:space:]]+"
         "([a-zA-Z0-9_-]+)" // subtype (e.g. "readme")
         "[[:space:]]+"
-        "(\"[^\"]+\"|[^[:space:]\"]+)" // path (may be quoted)
-        "([[:space:]]+([^[:space:]]+))?" // entry point
+        "(\"[^\"]+\"|[^[:space:]<>\"]+)" // path (may be quoted)
+        "([[:space:]]+([^[:space:]<>]+))?" // entry point
         , std::regex::extended);

     for (auto & output : outputs) {

The patch tightens the regex so < and > are rejected in path and entry-point fields, blocking HTML tag characters at the ingestion layer. Source: NixOS/hydra commit dea1e16.

text

// Fix in src/root/all.tt
 [% PROCESS common.tt %]

-<p>Showing builds [% (page - 1) * resultsPerPage + 1 %] - [% (page - 1) * resultsPerPage + builds.size %] out of [% total %] in order of descending finish time.</p>
+<p>Showing builds [% (page - 1) * resultsPerPage + 1 %] - [% (page - 1) * resultsPerPage + builds.size %] out of [% HTML.escape(total) %] in order of descending finish time.</p>

The template patch wraps user-influenced values in HTML.escape, ensuring HTML metacharacters are rendered as entities. Source: NixOS/hydra commit dea1e16.

Detection Methods for CVE-2025-54800

Indicators of Compromise

Build product entries in the Hydra database containing <, >, ", or script substrings in the path or entry-point columns.
Unexpected outbound HTTP requests from browsers of Hydra users immediately after loading a build or jobset page.
New or modified Hydra sessions, API tokens, or jobset definitions created shortly after a maintainer visited a build page for an untrusted project.

Detection Strategies

Query the Hydra database for build products whose stored fields contain HTML metacharacters and review the originating jobsets.
Enable and review web server access logs for anomalous Referer chains originating from /build/* pages.
Deploy a strict Content Security Policy (CSP) in report-only mode on the Hydra frontend to surface inline script violations tied to injected payloads.

Monitoring Recommendations

Alert on Hydra jobsets sourced from untrusted or newly added repositories that produce build products containing HTML characters.
Monitor authenticated Hydra API activity for privileged actions initiated from browser sessions that recently loaded third-party build pages.
Correlate reverse-proxy logs, CSP reports, and endpoint telemetry to identify browsers executing unexpected scripts from the Hydra origin.

How to Mitigate CVE-2025-54800

Immediate Actions Required

Update Hydra to a build that includes commit dea1e16 or later.
Audit the Hydra database for existing build product rows containing HTML metacharacters and purge or sanitize affected entries.
Rotate Hydra user session cookies and API tokens if untrusted projects have been built since the vulnerable version was deployed.

Patch Information

The fix is applied in commit dea1e168f590efb27db32dbacc82b09e15f8ae4b in the NixOS Hydra repository. It restricts allowed characters in build product parsing and applies HTML.escape in web templates. Full details are in the GitHub Security Advisory GHSA-7qwg-q53v-vh99 and the upstream commit.

Workarounds

Restrict Hydra to building only trusted, first-party packages until the patch is deployed.
Instruct users to avoid visiting the builds page for jobsets sourced from third-party projects until an upgrade is complete.
Deploy a strict Content Security Policy that disallows inline scripts on the Hydra web interface as a defense-in-depth control.

bash

# Update NixOS Hydra to include the patched commit
cd /path/to/hydra
git fetch origin
git checkout dea1e168f590efb27db32dbacc82b09e15f8ae4b
# Rebuild and restart the Hydra services
nix-build release.nix -A build.x86_64-linux
systemctl restart hydra-server hydra-queue-runner hydra-evaluator