npm/@capgo/cli CVE-2026-56236: medium 6.1, EPSS 0.18%
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Action: Upgrade @capgo/cli to 7.84.6 or later.
npm i @capgo/cli@7.84.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.84.6 | - |
Fixed versions
| 7.84.6 |
Sources
- osv: GHSA-8mpm-q7mh-8fvh
- nvd: CVE-2026-56236
- https://github.com/Cap-go/capgo/security/advisories/GHSA-8mpm-q7mh-8fvh
- https://github.com/Cap-go/CLI/commit/b8aa5ccbfad2d7f10f3cdbc00910d4a6aab026b2
- https://github.com/Cap-go/capgo
CVE-2026-56236 · published · modified · JSON