Vulnerability · Published Jun 21, 2026 · Assigned by VulnCheck
CVE-2026-56236Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations
Medium 6.1
In plain English
A medium-severity security flaw in cli from capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @capgo/cli | 7.84.6 | GHSA-8mpm-q7mh-8fvh |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
References
- GHSA Advisory GHSA-8mpm-q7mh-8fvh vendor-advisory
- VulnCheck Advisory: Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations third-party-advisory