CVE-2026-110451: Medium severity Nix Nix vulnerability
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
The issue affects Nix versions before 2.35.3 and Lix versions before 2.95.4 on macOS. It applies to unconfined builds.
What access does an attacker need to exploit this?
The CVSS vector identifies this as a local attack with low attack complexity. It does not require privileges or user interaction.
What is the expected impact if exploitation succeeds?
The vulnerability permits escape from the Seatbelt sandbox for an unconfined build. The supplied CVSS vector indicates an integrity impact, with no confidentiality or availability impact listed.
How can I determine whether an environment needs remediation?
Check whether the host is macOS, whether it runs Nix earlier than 2.35.3 or Lix earlier than 2.95.4, and whether it performs unconfined builds. Environments meeting all of those conditions are affected.
What remediation is identified?
Upgrade Nix to 2.35.3 or later, or Lix to 2.95.4 or later.