CVE-2026-49135

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49135
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49135.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49135
Published
2026-06-01T18:57:30.839Z
Modified
2026-07-08T08:13:39.608046516Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow
Details

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-377",
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49135.json"
}
References

Affected packages

Git / github.com/steipete/codexbar

Affected ranges

Type
GIT
Repo
https://github.com/steipete/codexbar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e7d932616508cee43ea9bcc63c269b14698de655
Fixed
1351961f4d6a286df8dc26cb6e021ab40e7b552d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.32.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.16.0
v0.16.1
v0.17.0
v0.18.0
v0.18.0-beta.1
v0.18.0-beta.2
v0.18.0-beta.3
v0.19.0
v0.2.0
v0.2.1
v0.2.2
v0.20
v0.20.0-beta.1
v0.21
v0.22
v0.23
v0.24
v0.25
v0.25.1
v0.26.0
v0.26.1
v0.27.0
v0.28.0
v0.29.0
v0.29.1
v0.3.0
v0.30.0
v0.30.1
v0.31.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.8.0
v0.8.1
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49135.json"