GHSA-8mpm-q7mh-8fvh
NoneCVSS
—
EPSS
—
Published
Mar 18, 2026
CISA due date
—
The record
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @capgo/cli | 0 | 7.84.6 |
Related vulnerabilities
- CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez Client… CWE-276
- CVE-2026-52766 YesWiki is a wiki system written in PHP. CWE-276
- CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped… CWE-276
- CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05… CWE-276
- CVE-2026-81302 PALLET CONTROL products contain an incorrect default permission vulnerability, which may… CWE-276
- CVE-2026-9634 A security issue exists within the Redundancy Module Configuration Tool. CWE-276
- CVE-2026-9633 A security issue exists within the Redundancy Module Configuration Tool. CWE-276
- CVE-2026-69665 SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default… CWE-276