CVE-2026-19755 - Vulnerability Details - OpenCVE

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nosleep	Nosleep

No data.

No data.

References

Link	Providers
https://fluidattacks.com/advisories/iggy
https://github.com/integralpro/nosleep/

History

Thu, 20 Aug 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.
Title		NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper
First Time appeared		Nosleep Nosleep nosleep
Weaknesses		CWE-862
CPEs		cpe:2.3:a:nosleep:nosleep:1.5.1::macos:::::
Vendors & Products		Nosleep Nosleep nosleep
References		https://fluidattacks.com/advisories/iggy https://github.com/integralpro/nosleep/
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2026-08-20T20:26:12.423Z

Updated: 2026-08-20T20:26:12.423Z

Reserved: 2026-08-13T15:38:11.224Z

Link: CVE-2026-19755

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-20T21:17:06.283

Modified: 2026-08-20T21:17:06.283

Link: CVE-2026-19755

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19755", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2026-08-13T15:38:11.224Z", "datePublished": "2026-08-20T20:26:12.423Z", "dateUpdated": "2026-08-20T20:26:12.423Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "NoSleep", "repo": "https://github.com/integralpro/nosleep", "vendor": "NoSleep", "versions": [{"status": "affected", "version": "1.5.1"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nosleep:nosleep:1.5.1:*:macos:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Oscar Uribe"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">NoSleep 1.5.1 </span><span style=\"background-color: rgb(255, 255, 255);\">exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled </span><code>command</code><span style=\"background-color: rgb(255, 255, 255);\"> and </span><code>NSBundlePath</code><span style=\"background-color: rgb(255, 255, 255);\"> values.</span><p>This issue affects NoSleep: 1.5.1.</p>"}], "value": "NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command\u00a0and NSBundlePath\u00a0values.This issue affects NoSleep: 1.5.1."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-08-20T20:26:12.423Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://fluidattacks.com/advisories/iggy"}, {"tags": ["product"], "url": "https://github.com/integralpro/nosleep/"}], "source": {"discovery": "UNKNOWN"}, "title": "NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "NoSleep", "repo": "https://github.com/integralpro/nosleep", "vendor": "NoSleep", "versions": [{"status": "affected", "version": "1.5.1"}]}], "source": "help@fluidattacks.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command\u00a0and NSBundlePath\u00a0values.This issue affects NoSleep: 1.5.1."}], "id": "CVE-2026-19755", "lastModified": "2026-08-20T21:17:06.283", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "help@fluidattacks.com", "type": "Secondary"}]}, "published": "2026-08-20T21:17:06.283", "references": [{"source": "help@fluidattacks.com", "url": "https://fluidattacks.com/advisories/iggy"}, {"source": "help@fluidattacks.com", "url": "https://github.com/integralpro/nosleep/"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "help@fluidattacks.com", "type": "Primary"}]}