Skip to content
OpenAdvisories

Product · NixOS

hydra

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-54864

    Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

    Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret …

    NixOS hydra
  • Medium 4.6
    CVE-2024-32657

    Hydra has persistent XSS vulnerability serving HTML build outputs

    Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients.…

    NixOS hydra