{"action":"Upgrade @capgo/cli to 7.84.6 or later.","affected":[{"fixed":"7.84.6","introduced":"0"}],"component":"@capgo/cli","cve_ids":["CVE-2026-56236"],"ecosystem":"npm","epss":0.00183,"exploited":false,"fixed_versions":["7.84.6"],"ghsa_id":"GHSA-8mpm-q7mh-8fvh","id":"tcs_01M5KFDGVAZ4PYBQ9J2J9KD3G2","modified_at":"2026-07-08T09:11:45.244975274Z","published_at":"2026-03-18T16:09:42Z","references":["https://osv.dev/vulnerability/GHSA-8mpm-q7mh-8fvh","https://github.com/Cap-go/capgo/security/advisories/GHSA-8mpm-q7mh-8fvh","https://github.com/Cap-go/CLI/commit/b8aa5ccbfad2d7f10f3cdbc00910d4a6aab026b2","https://github.com/Cap-go/capgo"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8mpm-q7mh-8fvh","url":"https://osv.dev/vulnerability/GHSA-8mpm-q7mh-8fvh"},{"source":"nvd","source_id":"CVE-2026-56236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56236"}],"summary":"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)"}