A size threshold mismanagement in Nix and Lix allows a local user on macOS to escape the operating system’s Seatbelt sandbox, giving additional privileges beyond the sandboxed environment. The flaw is classed as a sandbox escape and carries a moderate CVSS score of 4.3, indicating that while it does not provide arbitrary code execution, it can be used to bypass process isolation and potentially gain access to system resources or policies that are normally protected by the sandbox.

The vulnerability affects NixOS builds of Nix before version 2.35.3 and Lix before version 2.95.4 when run on macOS. Unconfined builds of these packages are particularly susceptible because the sandbox enforcement is disabled or weakened.

The EPSS score is less than 1 %, implying a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, further suggesting that widespread exploitation has not been observed. An attacker would need local access to the target macOS machine and would exploit the unconfined build to escape the Seatbelt sandbox, potentially allowing for reading privileged data or performing unauthorized actions that require elevated privileges.