CVE-2026-19755

Deferred Deferred - Pending Action

Privileged XPC Command Injection in NoSleep

Publication date: 2026-08-20

Last updated on: 2026-08-28

Assigner: Fluid Attacks

Description

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-28

Generated

2026-09-11

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-09

NVD

CVE-2026-19755

EUVD

EUVD-2026-63587

Affected Vendors & Products

Vendor	Product	Version / Range
fluidattacks	nosleep	1.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

NoSleep 1.5.1 has a vulnerability where it exposes a privileged XPC Mach service that accepts raw dictionary messages. Attackers can send messages with controlled command and NSBundlePath values, potentially leading to unauthorized actions or code execution.

Detection Guidance

This vulnerability involves a privileged XPC Mach service in NoSleep 1.5.1 that accepts attacker-controlled command and NSBundlePath values. Detection requires checking for the presence of NoSleep 1.5.1 and inspecting XPC service configurations for insecure message handling.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary commands on your system with elevated privileges. It may lead to unauthorized data access, system compromise, or further attacks depending on the commands executed.

Compliance Impact

The vulnerability in NoSleep 1.5.1 allows arbitrary command execution via a privileged XPC Mach service, which could lead to unauthorized access or data manipulation. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to sensitive information.

Mitigation Strategies

Immediately update NoSleep to the latest version that addresses this issue. If no update is available, consider uninstalling the software until a patch is released.

Hi! I’m here to help you understand CVE-2026-19755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70