Cyber Resilience

CVE-2025-32435

Low

Published: 15 April 2025

Published
15 April 2025
Modified
22 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0037 59.1th percentile
Risk Priority 5 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-32435 is a low-severity Eval Injection (CWE-95) vulnerability in Nixos Hydra. Its CVSS base score is 2.6 (Low).

Operationally, ranked in the top 40.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner…

more

and hydra-www users respectively.

CWE(s)
CWE-95

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nixos
hydra
≤ 2025-04-11

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References