CVE-2026-110451: Nix/Lix Sandbox Escape Vulnerability

CVE-2026-110451 Overview

CVE-2026-110451 is a sandbox escape vulnerability affecting Nix before version 2.35.3 and Lix before version 2.95.4 on macOS. The flaw stems from improper handling of a size threshold in the Seatbelt sandbox used to isolate unconfined builds. A local user running an unconfined build can bypass sandbox restrictions and influence resources outside the intended confinement boundary. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
A local attacker can escape the Seatbelt sandbox during an unconfined Nix build on macOS, breaking the integrity boundary enforced by the build sandbox.

Affected Products

Nix versions prior to 2.35.3 on macOS
Lix versions prior to 2.95.4 on macOS
macOS systems using Seatbelt-based build sandboxing with unconfined builds enabled

Discovery Timeline

2026-10-14 - CVE-2026-110451 published to NVD
2026-10-14 - Last updated in NVD database
October 2026 - NixOS Security Advisory published

Technical Details for CVE-2026-110451

Vulnerability Analysis

Nix and Lix on macOS rely on Apple's Seatbelt (sandbox_init) framework to isolate build processes. The vulnerability occurs because a specific size threshold used by the sandbox profile logic is mishandled, which permits an unconfined build to perform operations the sandbox should block. The underlying weakness is an authorization check that fails under boundary conditions, allowing the build process to act outside the policy intended by the Nix daemon.

The attack requires local access and no privileges or user interaction. The scope is marked as changed, meaning the compromise crosses a security boundary from the sandboxed build into the broader macOS environment. Impact is limited to integrity; confidentiality and availability are not directly affected. The EPSS probability remains low, consistent with a locally scoped build-system issue rather than a broadly exploited remote flaw.

Root Cause

The root cause is incorrect authorization logic ([CWE-863]) tied to a size threshold check in the macOS Seatbelt sandbox integration. When data crossing this threshold is processed, the sandbox policy evaluation does not enforce the intended restrictions on an unconfined build. This gap allows build-time code paths to perform actions outside the sandbox profile.

Attack Vector

An attacker with the ability to submit or trigger a build on a vulnerable Nix or Lix installation on macOS can craft inputs that exercise the mishandled threshold. The build then escapes the Seatbelt sandbox, enabling modification of files or resources that should be isolated. Exploitation is local and does not require authentication to the Nix daemon beyond the ability to initiate a build.

No public proof-of-concept exploit is available. Technical specifics are described in the NixOS Security Advisory October 2026.

Detection Methods for CVE-2026-110451

Indicators of Compromise

Nix or Lix daemon versions below 2.35.3 and 2.95.4 respectively running on macOS build hosts
Unexpected file writes or process activity originating from nix-build or nix-daemon outside standard /nix/store paths
Build derivations configured as unconfined on macOS runners

Detection Strategies

Inventory macOS build systems and query installed Nix and Lix versions against the fixed releases
Review build logs for derivations using unconfined sandbox modes and correlate with file-system changes outside expected build outputs
Monitor Seatbelt policy violations and sandbox_init related syslog entries on macOS build hosts

Monitoring Recommendations

Enable endpoint telemetry on macOS CI and developer workstations to capture process ancestry for nix-daemon child processes
Alert on write operations by build processes to paths outside /nix/store and the configured build directory
Track changes to Nix configuration files such as /etc/nix/nix.conf that enable unconfined builds

How to Mitigate CVE-2026-110451

Immediate Actions Required

Upgrade Nix to version 2.35.3 or later on all macOS hosts
Upgrade Lix to version 2.95.4 or later on all macOS hosts
Audit build configurations and disable unconfined builds where not strictly required
Restrict which users can trigger builds on shared macOS build hosts

Patch Information

Upstream fixes are available in Nix 2.35.3 and Lix 2.95.4. Refer to the NixOS Security Advisory October 2026 for the full list of fixed releases, backports, and distribution packages.

Workarounds

Disable unconfined builds in nix.conf by removing or restricting the sandbox = relaxed setting on macOS
Isolate macOS build hosts in dedicated VMs or ephemeral runners that are rebuilt between jobs
Limit daemon access using Unix socket permissions and restrict the trusted-users and allowed-users settings

bash

# Configuration example: enforce sandboxed builds in /etc/nix/nix.conf
sandbox = true
extra-sandbox-paths =
trusted-users = root
allowed-users = @admin