Nosleep
Monthly
Unauthorized XPC Mach service access in NoSleep 1.5.1 on macOS allows a local low-privileged attacker to send arbitrary dictionary messages - including attacker-controlled `command` and `NSBundlePath` values - to a privileged daemon without authorization. The root cause is CWE-862 (Missing Authorization), meaning the XPC service performs no caller identity check before processing requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized XPC Mach service access in NoSleep 1.5.1 on macOS allows a local low-privileged attacker to send arbitrary dictionary messages - including attacker-controlled `command` and `NSBundlePath` values - to a privileged daemon without authorization. The root cause is CWE-862 (Missing Authorization), meaning the XPC service performs no caller identity check before processing requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.