Is there a patch available for CVE-2026-56236?

Yes, a patch is available for CVE-2026-56236. Update the affected software to the latest version immediately.

Capgo CLI CVE-2026-56236

Q: What is the CVSS score of CVE-2026-56236?

CVE-2026-56236 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38165 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-06-21 VulnCheck

GHSA-4ch8-prch-6prf

Information Disclosure Cli Capgo

6.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Local vector because attacker pre-plants symlinks in a repo; UI:R for mandatory developer CLI invocation; C:L for world-readable credential exposure; I:H for arbitrary file overwrite.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:34 vuln.today

Analysis Generated

Jun 22, 2026 - 06:34 vuln.today

Patch available

Jun 21, 2026 - 15:31 EUVD

DescriptionCVE.org

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

AnalysisAI

Symlink-following vulnerabilities in Capgo CLI before version 12.128.2 (npm @capgo/cli < 7.84.6) allow an attacker who controls a repository to overwrite arbitrary files on a developer's machine and expose sensitive signing credentials when the developer runs CLI login or build credential operations inside that repository. Three distinct issues are present: unsafe writeFileSync on .capgo and .capgo-credentials.json without symlink validation, and global credential files written with world-readable 664 permissions instead of the required 0600. A proof-of-concept demonstrating the .capgo clobber is publicly documented in the GitHub Security Advisory GHSA-8mpm-q7mh-8fvh. No CISA KEV listing exists at time of analysis, but exploitability is straightforward given the PoC and low attack complexity.

Technical ContextAI

Capgo CLI (cpe:2.3:a:capgo:cli:*:*:*:*:*:*:*:*) is an npm-distributed command-line tool for the Capgo Capacitor live-update platform. The root cause is CWE-59 (Improper Link Resolution Before File Access - Link Following): the CLI performs writeFileSync() and writeFile() operations on filenames relative to the current working directory (.capgo, .capgo-credentials.json) without first checking whether those paths resolve through a symbolic link. Issue 1 is in src/login.ts, which writes the API key before validating it with verifyUser(), meaning symlink exploitation succeeds even on failed authentication. Issue 2 is in src/build/credentials.ts, which writes credential JSON without any symlink guard and without requiring the user to be authenticated. Issue 3 is also in src/build/credentials.ts: the global path at $HOME/.capgo-credentials/credentials.json is created with default umask-derived 664 permissions rather than the hardened 0600, exposing Android keystore data, Play Store configuration, and iOS signing certificates on multi-user or CI systems.

RemediationAI

The primary fix is to upgrade @capgo/cli to version 7.84.6 or later via npm (npm install -g @capgo/cli@7.84.6 or equivalent). The upstream patch is available at https://github.com/Cap-go/CLI/commit/b8aa5ccbfad2d7f10f3cdbc00910d4a6aab026b2 and the vendor advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-8mpm-q7mh-8fvh. If an immediate upgrade is not possible, avoid running any capgo login --local or capgo build credentials save --local commands inside repositories you do not fully control or that originate from untrusted contributors - this eliminates the primary trigger condition. As a compensating control for the permissions issue (Issue 3), manually chmod 600 $HOME/.capgo-credentials/credentials.json and chmod 700 $HOME/.capgo-credentials/ after each credentials write. On CI systems, isolate the runner user and ensure credential directories are not world- or group-readable as a baseline hardening measure. Note that these workarounds do not address the underlying symlink-following flaw and should only be used as a bridge to patching.