CVE-2025-54800

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.

• CWE-79

• https://github.com/NixOS/hydra/commit/dea1e168f590efb27db32dbacc82b09e15f8ae4bPatch
• https://github.com/NixOS/hydra/security/advisories/GHSA-7qwg-q53v-vh99Patch, Vendor Advisory

Published

Aug 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54795Claude Code is an agentic coding tool. In versions below 1.0…9.8
• CVE-2025-54796Copyparty is a portable file server. Versions prior to 1.18.…7.5
• CVE-2025-54797Rejected reason: This CVE is a duplicate of CVE-2025-52464.
• CVE-2025-54798tmp is a temporary file and directory creator for node.js. I…5.3
• CVE-2025-54799Let's Encrypt client and ACME library written in Go (Lego). …2.3
• CVE-2025-5480Action1 Uncontrolled Search Path Element Local Privilege Esc…7.8
• CVE-2025-54801Fiber is an Express inspired web framework written in Go. In…7.5
• CVE-2025-54802pyLoad is the free and open-source Download Manager written …9.8
• CVE-2025-54803js-toml is a TOML parser for JavaScript, fully compliant wit…7.5
• CVE-2025-54804Russh is a Rust SSH client & server library. In versions 0.5…6.5
• CVE-2025-54805When an iRule is configured on a virtual server via the decl…6.5
• CVE-2025-54806GROWI v4.2.7 and earlier contains a cross-site scripting vul…6.1