steipete CodexBar up to 0.31.x App Store Connect API temp file

Summaryinfo

A vulnerability marked as problematic has been reported in steipete CodexBar up to 0.31.x. This vulnerability affects unknown code of the component App Store Connect API. This manipulation causes temp file. This vulnerability is tracked as CVE-2026-49135. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in steipete CodexBar up to 0.31.x. Affected by this vulnerability is an unknown code of the component App Store Connect API. The manipulation with an unknown input leads to a temp file vulnerability. The CWE definition for the vulnerability is CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

The weakness was disclosed by Chia Min Jun Lennon. The advisory is shared at github.com. This vulnerability is known as CVE-2026-49135 since 05/27/2026. The exploitation appears to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.32.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch e7d932616508cee43ea9bcc63c269b14698de655 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• steipete

Name

• CodexBar

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31

License

• open-source

Website

• Product: https://github.com/steipete/CodexBar/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion