A privilege escalation flaw in Nix 2.30.0 allows builds on macOS to execute with elevated root privileges, posing a significant risk to system integrity.

The vulnerability is a privilege dropping or lowering error (CWE-271) where the package manager fails to transition to a restricted build user during the build process. This allows local authenticated users with low privileges to execute build operations with root-level access.

The ability for a local user to execute build processes as root can lead to a total compromise of the host system. Given the CVSS score of 7.9, this vulnerability is classified as High severity, as it facilitates unauthorized code execution with maximum system privileges, potentially leading to data exfiltration or system-wide configuration changes.

Immediate Action: Upgrade to Nix version 2.30.1 or later to resolve the privilege dropping defect.

Proactive Monitoring: Review system logs for unusual build activity or unauthorized execution of processes by standard users.

Compensating Controls: Restrict access to the machine to authorized users only, and ensure that the build environment is isolated from sensitive system resources.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical failure in the security boundary of the Nix build process on macOS. Administrators must prioritize updating to version 2.30.1 immediately to prevent local privilege escalation. Because there are no known workarounds, the application of the vendor-provided patch is the only effective method to mitigate this risk.