CVE-2020-11498: 
NixOS vulnerability analysis and mitigation

Slack Nebula through version 1.1.0 contains a relative path vulnerability that was discovered in early 2020. The vulnerability affects the core functionality of Nebula, specifically in the tun_darwin.go and tun_windows.go components (NVD).

The vulnerability allows a low-privileged attacker to execute code by exploiting relative path handling in the system. The issue specifically affects how Nebula handles paths in tun_darwin.go and tun_windows.go files, where the application fails to use absolute paths when executing system binaries, instead relying on whatever is in the PATH (GitHub PR).

If successfully exploited, this vulnerability can lead to code execution in the context of the root user. Additionally, users can leverage Nebula to execute arbitrary code in their own context, which could be used for user-level persistence or to bypass security controls (NVD).

The vendor has noted that exploitation "requires a high degree of access and other preconditions that are tough to achieve," which somewhat mitigates the risk (NVD).

The vulnerability was addressed by implementing absolute paths for system binaries instead of relying on PATH variables. This fix was implemented in a pull request that modified how paths are handled on Darwin and Windows systems (GitHub PR).