CVE-2026-56236 Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations
Attackers can overwrite arbitrary files or expose credentials via malicious symlinks when developers run the Capgo CLI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56236?
CVE-2026-56236 is a medium-severity path traversal vulnerability in capgo cli, published on 21 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.
Weakness: CWE-59
Which versions are affected by CVE-2026-56236?
2 open source packages ship an affected version, including @capgo/cli.
| Package | Affected | Fixed in |
|---|---|---|
@capgo/cli npm | All versions | 7.84.6 |
@capgo/cli npm | All versions | 7.84.6 |
How do I fix CVE-2026-56236?
Upgrade @capgo/cli to 7.84.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-56236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56236 exists.
Sources
Also known as GHSA-4ch8-prch-6prf, GHSA-8mpm-q7mh-8fvh.