Vulnerability · Published Jun 1, 2026 · Assigned by VulnCheck

CVE-2026-49135CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow

High 7.1

In plain English

A high-severity security flaw in CodexBar from steipete. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 97.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

Affected products (as reported)

Vendor	Product	Versions
steipete	CodexBar	0 – before 0.32.0

Weakness: CWE-377, CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/steipete/CodexBar/releases/tag/v0.32.0 release-notes
https://github.com/steipete/CodexBar/pull/1228 issue-tracking
https://github.com/steipete/CodexBar/commit/e7d932616508cee43ea9bcc63c269b14698de655 patch
https://www.vulncheck.com/advisories/codexbar-insecure-temporary-file-handling-in-notarization-workflow third-party-advisory