A crafted optional configuration file can trigger an escape-to-host action in the nspawn component of systemd versions 233 to 259. The vulnerability permits an attacker to break out of the isolated container and gain elevated privileges on the host. The weakness is identified as CWE‑348, indicating a privilege‑escalation flaw. The impact is that an attacker who can supply a malicious config file could execute arbitrary commands with elevated rights, potentially compromising confidentiality, integrity, and availability of the host system.

Affected systems are those running systemd versions 233 through 259 inclusive. This includes many Linux distributions that ship with these releases, and the nspawn service on those systems is vulnerable. Without more granular version data, any system within that range is at risk until it is upgraded.

The CVSS base score of 6.4 denotes a moderate severity. No EPSS score is available, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in CISA's KEV catalog, yet it remains present in widely deployed systemd releases. The likely attack vector is a local or authenticated user who can create or modify optional configuration files read by nspawn; exploitation requires only the ability to supply a crafted file, which in turn can trigger the escape-to-host action and execute arbitrary shell commands on the host.