GNU Guix vulnerabilities

4 CVEs affecting GNU Guix, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-59378, published 2025-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-18192, published 2019-10-17. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.
CVE-2021-27851, published 2021-04-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having…
CVE-2024-52867, published 2024-11-17. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are…
CVE-2025-59378, published 2025-09-15. Medium severity, CVSS 5.7. EPSS: 0.1% chance of exploitation in the next 30 days. In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it…