What’s Vulnerable › Vulnerabilities

CVE-2026-49135: CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-59

Description

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

Affected products

• steipete CodexBar: before 0.32.0 — fixed in 0.32.0

How to fix

Upgrade to a fixed version: steipete CodexBar 0.32.0. Check the vendor advisory for mitigations.

References

• https://github.com/steipete/CodexBar/commit/e7d932616508cee43ea9bcc63c269b14698de655
• https://github.com/steipete/CodexBar/pull/1228
• https://github.com/steipete/CodexBar/releases/tag/v0.32.0
• https://www.vulncheck.com/advisories/codexbar-insecure-temporary-file-handling-in-notarization-workflow
• https://github.com/steipete/CodexBar/pull/1228

Get alerted when CVE-2026-49135 or the next vulnerability affects your stack