CVE-2026-110451

Deferred Deferred - Pending Action

Seatbelt Sandbox Escape in Nix and Lix on macOS

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: MITRE

Description

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110451

EUVD

EUVD-2026-100807

Affected Vendors & Products

Vendor	Product	Version / Range
NixOS	Nix	0
NixOS	Nix	2.29.0
NixOS	Nix	2.31.0
NixOS	Nix	2.32.0
NixOS	Nix	2.35.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves a sandbox escape in Nix and Lix software on macOS. It occurs because a specific size threshold is mishandled, allowing an unconfined build to bypass the Seatbelt sandbox. This enables malicious code to execute outside the restricted environment.

Detection Guidance

This vulnerability is specific to Nix and Lix software versions before 2.35.3 and 2.95.4 respectively on macOS. Detection primarily involves checking installed versions and configurations rather than running commands. Verify if your Nix or Lix version is below the patched versions (2.35.3 for Nix, 2.95.4 for Lix) using 'nix --version' or 'lix --version'. Check for untrusted derivation builds and macOS sandbox settings.

Impact Analysis

If you use Nix or Lix on macOS with sandbox enabled, an attacker could escape the sandbox and gain unauthorized access to your system. This could lead to data theft, system compromise, or further exploitation depending on your environment.

Compliance Impact

This vulnerability primarily involves a sandbox escape on macOS for unconfined builds, which could allow unauthorized access to system resources. While not directly tied to GDPR or HIPAA, such a flaw could potentially lead to unauthorized data access or modification, violating principles of data integrity and confidentiality required by these regulations. Organizations handling sensitive data under GDPR or HIPAA may face compliance risks if this vulnerability is exploited.

Mitigation Strategies

Upgrade Nix to version 2.35.3 or later and Lix to version 2.95.4 or later. Use the provided upgrade scripts or commands from the advisory. Check for bad store ownership in fresh installations and ensure proper authorization for Nix daemon clients.

Hi! I’m here to help you understand CVE-2026-110451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70