CVE-2025-53813: TCC Bypass via misconfigured Node fuses in Nozbe

Severity: medium (CVSS 4.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-276

Description

The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2025.11 of Nozbe.

Affected products

Nozbe: before 2025.11 — fixed in 2025.11

How to fix

Upgrade to a fixed version: Nozbe 2025.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-53813 or the next vulnerability affects your stack