CodexBar vulnerabilities

A credential forwarding vulnerability in CodexBar before 0.33.0 allows network-adjacent attackers to intercept sensitive credentials via cross-origin or HTTP-downgrade redirects. Attackers can redirect credentialed requests carrying cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination.

CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.

CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.

CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.