CVE-2026-49135
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.
Risk Assessment
A local attacker can access sensitive App Store Connect credentials, tamper with build artifacts, or disrupt the notarization process, potentially compromising software integrity.
Recommendation
Update CodexBar to version 0.32.0 or later. Restrict system access to trusted users only. Consider using more secure API key storage mechanisms.
Other vulnerabilities in CodexBar
See all- CVE-2026-49949Medium
A credential forwarding vulnerability in CodexBar before 0.33.0 allows network-adjacent attackers to intercept sensitive credentials via cross-origin or HTTP-downgrade redirects. Attackers can redirect credentialed requests carrying cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination.
- CVE-2026-49134High
CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.
- CVE-2026-43625Medium
CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.
Original NVD description (English source)
CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.