CVE-2026-49134

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/steipete/CodexBar/commit/dbc944d46cd4cf7877d1ca47c44556fe573b46e8
https://github.com/steipete/CodexBar/pull/1222
https://github.com/steipete/CodexBar/releases/tag/v0.32.0
https://www.vulncheck.com/advisories/codexbar-privilege-escalation-via-cli-installer-temp-file
https://github.com/steipete/CodexBar/pull/1222

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-01 21:16

Updated : 2026-07-22 08:10

NVD link : CVE-2026-49134

Mitre link : CVE-2026-49134

CVE.ORG link : CVE-2026-49134

JSON object : View

Products Affected

No product.

CWE

CWE-377

Insecure Temporary File

{"id": "CVE-2026-49134", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49134", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T12:38:47.403866Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/steipete/CodexBar", "vendor": "steipete", "product": "CodexBar", "versions": [{"status": "affected", "version": "0", "lessThan": "0.32.0", "versionType": "semver"}], "packageURL": "pkg:github/steipete/CodexBar", "defaultStatus": "affected"}]}], "published": "2026-06-01T21:16:46.353", "references": [{"url": "https://github.com/steipete/CodexBar/commit/dbc944d46cd4cf7877d1ca47c44556fe573b46e8", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/steipete/CodexBar/pull/1222", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/steipete/CodexBar/releases/tag/v0.32.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/codexbar-privilege-escalation-via-cli-installer-temp-file", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/steipete/CodexBar/pull/1222", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root."}, {"lang": "es", "value": "CodexBar anterior a la versi\u00f3n 0.32.0 contiene una vulnerabilidad de escalada de privilegios en el instalador de CLI que permite a atacantes locales ejecutar comandos arbitrarios como root explotando una condici\u00f3n de carrera en el manejo de archivos temporales. El instalador crea un archivo temporal con mktemp, escribe una carga \u00fatil de shell privilegiada en \u00e9l y lo ejecuta con privilegios de administrador a trav\u00e9s de bash, permitiendo que un proceso local del mismo usuario reescriba el cuerpo del instalador antes de que se apruebe la solicitud del administrador, lo que provoca que los comandos controlados por el atacante se ejecuten como root."}], "lastModified": "2026-07-22T08:10:00.117", "sourceIdentifier": "disclosure@vulncheck.com"}