- Path traversal in `/log` endpoint: arbitrary file read under `$HYDRA_DATA` · Advisory · NixOS/hydra · GitHub
- Stored XSS via the homepage links of projects/packages · Advisory · NixOS/hydra · GitHub
were disclosed today, with the migrations merged in
- Hydra: Merge pull request #2032 from NixOS/xss-homepage-links · NixOS/hydra@12053f3 · GitHub
- Lix’s Hydra: https://git.lix.systems/lix-project/hydra/commit/b7b04cfe81764e6a5728c17d79d9826f1070a48d
- Hydra in Nixpkgs bumped in hydra: 0-unstable-2026-10-27 -> 0-unstable-2026-11-03 by GaetanLepage · Pull Request #582719 · NixOS/nixpkgs · GitHub.
hydra.nixos.org was already hardened via a proxy server configuration change. A Lix deployment (I do not know what URL) was likewise already hardened. The CUDA team’s deployment at hydra.nixos-cuda.org was also hardened. This would be done by limiting the log endpoint to disallow .. as a “store path”. Example nginx:
@hydra_log_dot vars_regexp {http.request.uri.path} ^/log/\.|(^|/)\.\.?(/|$)
handle @hydra_log_dot {
respond
}
Hydra deployers should update and/or likewise update their proxy server configurations.
Thank you to LeSuisse (Thomas Gerbet) · GitHub for reporting the issues (I do not know Discourse handle), and for @ma27 and @glepage for joining me on call today to release everyone synchronously.
Happy integrating continuously, everyone!