EUVD-2026-100807
GHSA-5h53-jg3j-22gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun or submit malicious Nix/Lix build on macOS
-
ExploitTrigger mishandled size threshold in Seatbelt sandbox
-
ExecutionEscape sandbox confinement
-
ImpactTamper with host resources outside sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the affected software (Nix before 2.35.3 or Lix before 2.95.4) running specifically on macOS, where the Seatbelt sandbox is used to confine builds. The attacker must be able to run or submit a build (an 'unconfined build') whose crafted input mishandles a certain size threshold, allowing the build process to break out of the Seatbelt sandbox. Limiting factors: local access is required (no remote vector), the platform must be macOS (Linux/other sandboxes are unaffected), and the attacker needs the ability to have a build evaluated on the host - making multi-user build servers, CI runners, and systems that evaluate untrusted derivations the realistic exposure. |
| Impact | This is a low-to-moderate priority issue rather than an urgent one. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, base 4.3) describes a LOCAL sandbox escape with no confidentiality or availability impact and only LOW integrity impact, elevated slightly by a scope change (S:C) because the attacker crosses the Seatbelt sandbox boundary. The local attack vector (AV:L) is the dominant limiting factor: an attacker must already be able to run a build on the affected macOS host, so this is a defense-in-depth/privilege-boundary weakness, not a remotely reachable flaw. No KEV listing, no POC, and no EPSS score were provided, so there is no evidence of active exploitation or a published exploit - consistent with the modest CVSS. One caveat: PR:N is scored because the malicious build itself is 'unconfined,' but in practice the attacker needs the ability to submit/run a Nix or Lix build, so real-world preconditions are stronger than PR:N alone implies. Verify the exploitation entry point (who can submit builds) with site-specific trust configuration. |
| Exploit ScenarioDerived | On a macOS system running an affected Nix (<2.35.3) or Lix (<2.95.4), an attacker who can get a build evaluated - for example a shared build machine, CI runner, or a user importing an untrusted derivation - crafts a build that mishandles a certain size threshold to break out of the Seatbelt sandbox. Once outside the sandbox the build process can tamper with resources beyond its intended confinement. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Seatbelt sandbox escape on macOS in Nix before 2.35.3 and Lix before 2.95.4 lets a local attacker cause a crafted build to break out of the macOS Seatbelt confinement via a mishandled size threshold, yielding limited integrity impact (C:N/I:L/A:N). There is no public exploit identified at time of analysis and no confirmed active exploitation, and the issue is assessed as low-to-moderate priority because exploitation requires local access on macOS plus the ability to have a build evaluated on the host, such as on multi-user build servers or CI runners processing untrusted derivations. Unauthenticated local access is consistent with the CVSS vector (PR:N).
RemediationAI
Upgrade to the fixed versions: Nix 2.35.3 or later and Lix 2.95.4 or later, per the vendor advisory at https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547. If immediate upgrade is not possible, reduce exposure by preventing untrusted users or CI jobs from submitting builds to macOS builders, running untrusted derivations in isolated disposable macOS VMs instead of shared hosts, and reviewing which derivations are marked for unconfined evaluation; these controls can break existing multi-user build workflows and may require reconfiguring CI trust boundaries. Since the issue is local and macOS-specific, restricting build access to trusted operators and separating high-risk build jobs from production credentials limits impact, though it does not replace the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nix and its fork Lix are package managers that build derivations in isolated sandboxes; on macOS, Nix uses Apple's Seatbelt sandbox to constrain build processes. CVE-2026-110451 stems from a mishandled size threshold that lets a crafted build escape that Seatbelt confinement, classified as CWE-863 Incorrect Authorization because the sandbox enforcement/authorization check is bypassed. The affected CPE is cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*, indicating Nix components across versions prior to the fixed releases; Lix is affected before 2.95.4, and the flaw is specific to macOS builds rather than Linux or other sandbox backends. The CVSS vector AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N confirms a local, no-user-interaction issue with scope change and only low integrity impact; the attacker must be able to submit or run an unconfined build on the macOS host.
Know when Nix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Local-only sandbox escape (AV:L) requiring a runnable build but no prior privilege in the scored model (PR:N); crossing the sandbox boundary is a scope change (S:C) with limited integrity impact and no C/A effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the use
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2
Nix is a package manager for Linux and other Unix systems. Rated high severity (CVSS 8.8), this vulnerability is remotel
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate
An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-b
Nix releases before 2.35.3 in unsandboxed macOS or FreeBSD deployments permit a local authenticated build user to establ
Local privilege escalation in Nix before 2.35.3 allows a local attacker with access to the user account that installed t
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recu
Exploit-DB