Dashboard / CVE-2026-49135

CVE-2026-49135

HIGH
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-06-01 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
AT: Present
VC: High
VI: High
VA: None

Description

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
steipete CodexBar 0 < 0.32.0

References & Advisories (4)

Bug Bounty Relevance

39 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.13%
Raw Score 0.001290
Percentile 2.6%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links