CVE-2026-56236

6.1 Moyenne

Publiée le 21/06/2026 à 16:16 · Modifiée le 08/10/2026 à 18:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

Traduire en français

Produits concernés

capgo cli

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.8 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.1 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-59

Références

https://github.com/Cap-go/capgo/security/advisories/GHSA-8mpm-q7mh-8fvh
https://www.vulncheck.com/advisories/capgo-cli-arbitrary-file-overwrite-via-symlink-following-in-local-credential-operations

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories