PT-2026-45558 · Steipete+1 · Codexbar

Hinotoi-Agent · CVE-2026-49135 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CodexBar versions prior to 0.32.0

Description Insecure temporary file handling in the release notarization workflow allows local attackers to access sensitive credentials or tamper with build artifacts. This is possible by exploiting predictable file paths, enabling attackers on the same host to read the App Store Connect API key written to a fixed path. Additionally, attackers can pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations or modify notarization archives before they are submitted.

Recommendations Update CodexBar to version 0.32.0 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-377

Related Identifiers

CVE-2026-49135

Affected Products

Codexbar

References · 9

• 🔥 https://github.com/steipete/CodexBar/pull/1228 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49135.json · Exploit
• https://github.com/steipete/CodexBar/commit/e7d932616508cee43ea9bcc63c269b14698de655 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49135 · Security Note
• https://osv.dev/vulnerability/CVE-2026-49135 · Vendor Advisory
• https://github.com/steipete/CodexBar · Note
• https://github.com/steipete/CodexBar/releases/tag/v0.32.0 · Note
• https://t.me/cveNotify/211646 · Telegram Post
• https://vulncheck.com/advisories/codexbar-insecure-temporary-file-handling-in-notarization-workflow · Note