Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-56236

Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

capgo cli

Default version status: unaffected

  • 0 to < 12.128.2affected
  • 12.128.2unaffected
pkg:npm/%40capgo/cli

References