CVE-2025-32435 LOW

CVE-2025-32435: Hydra no restricted eval after nix-eval-jobs migration

Vendor Nixos
Product hydra
Weakness CWE-95 · Eval injection
Published April 15, 2025
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

2.6/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.

Key dates

02Disclosure timeline

April 15, 2025 CVE published
April 16, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-31996 XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution CVE-2026-29091 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection CVE-2026-22666 Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() CVE-2026-4965 letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection CVE-2021-23277 Improper Neutralization of Directives in Dynamically Evaluated Code