nono is software that allows users to run AI agents in a zero‑latency sandbox. Prior to version 0.55.0, the sandbox policies permit access to local Unix domain sockets, including the per‑user systemd‑dbus socket. This flaw allows a sandboxed process to communicate with that socket and escape the sandbox. The issue is an Improper Restriction of Tested Operations for Authorization, identified as CWE‑863. Version 0.55.0 resolves the problem.

The affected product is nono from always‑further. All releases before 0.55.0 are vulnerable. Version 0.55.0 and later contain the fix.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. Based on the description, it is inferred that the likely attack vector is an attacker running within the same user context as the nono instance, who can communicate with the per‑user systemd‑dbus socket established by the sandbox policy. This inference comes from the fact that the sandbox permits access to local Unix domain sockets, allowing escape. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are reported in the available data.