---
id: CVE-2026-49135
title: CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow
summary: >-
  CodexBar prior to 0.32.0 contains an insecure temporary file handling
  vulnerability that allows local attackers to access sensitive credentials or
  tamper with build artifacts by exploiting predictable file paths in the
  release notarizati…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-377
  - CWE-59
vendor: steipete
product: CodexBar
affected:
  - CodexBar < 0.32.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-02T13:27:11.195007Z'
exploitAvailable: true
published: '2026-06-01'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:46.127Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49135'
references:
  - url: 'https://github.com/steipete/CodexBar/releases/tag/v0.32.0'
    label: CodexBar 0.32.0 Release Notes
  - url: 'https://github.com/steipete/CodexBar/pull/1228'
  - url: >-
      https://github.com/steipete/CodexBar/commit/e7d932616508cee43ea9bcc63c269b14698de655
  - url: >-
      https://www.vulncheck.com/advisories/codexbar-insecure-temporary-file-handling-in-notarization-workflow
tags:
  - cve.org
  - exploit-available
epss: 0.00129
epssPercentile: 0.02603
ingestedAt: '2026-11-08T14:51:22.393Z'
---

## Overview

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

## Affected

- `CodexBar < 0.32.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.