Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-32435

Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.

Published

2025-04-15T23:15:42.983

Last Modified

2025-09-22T14:56:23.283

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 2.6 (LOW)

Weaknesses

Type: Secondary
CWE-95

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nixos	hydra	< 2025-04-11	Yes

References

https://github.com/NixOS/hydra/commit/8d750265135b7e203520036a742afdf301b4013f Patch ([email protected])
https://github.com/NixOS/hydra/security/advisories/GHSA-j7w7-965w-vjxw Vendor Advisory ([email protected])
https://github.com/NixOS/nixpkgs/pull/397919 Issue Tracking ([email protected])
https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.28.1 Release Notes ([email protected])