CVE-2026-49134: CodexBar Privilege Escalation Vulnerability

CVE-2026-49134 Overview

CVE-2026-49134 is a local privilege escalation vulnerability in CodexBar versions prior to 0.32.0. The flaw resides in the CLI installer, which creates a temporary file using mktemp, writes a privileged shell payload into it, and executes that file with administrator privileges through bash. A same-user local process can rewrite the installer body between file creation and administrator approval. When the user approves the elevation prompt, attacker-controlled commands execute as root. The issue is tracked as CWE-377: Insecure Temporary File and was remediated in CodexBar v0.32.0.

Critical Impact

A local attacker running as the same user can substitute the installer payload during the approval window and gain arbitrary command execution as root.

Affected Products

• CodexBar versions prior to 0.32.0
• CLI installer component that uses mktemp and bash for elevation
• macOS and Unix-like systems where CodexBar is installed via the CLI

Discovery Timeline

• 2026-06-01 - CVE-2026-49134 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49134

Vulnerability Analysis

The CodexBar CLI installer follows an insecure pattern when escalating privileges. It generates a temporary file path with mktemp, writes a shell script payload into that file, and then invokes the script with administrator rights using bash. Because the temporary file remains writable by the invoking user between creation and execution, a co-resident process running under the same user identity can overwrite the script contents. The user-facing administrator prompt does not validate the script body after approval, so the elevated bash interpreter reads and executes whatever payload exists at the moment of execution. This results in arbitrary command execution as root, even though the installer was intended to run a fixed, vendor-supplied payload.

Root Cause

The root cause is improper handling of a temporary file used as an elevation vehicle [CWE-377]. The installer trusts the integrity of a file path it does not lock or verify between write and execute. Combined with an asynchronous user-approval prompt, this creates a time-of-check to time-of-use race window during which the file body can be replaced.

Attack Vector

Exploitation requires a local process running as the same user that invokes the CodexBar installer. The attacker monitors for the mktemp-generated path, then overwrites the file contents before the user approves the administrator prompt. When approval completes, bash executes the substituted payload with root privileges. No network access or additional credentials are required, but user interaction with the elevation prompt is necessary for the exploit chain to complete.

No public proof-of-concept code is available. Technical details are described in the VulnCheck Advisory: CodexBar Escalation and the upstream fix in the GitHub Commit Reference.

Detection Methods for CVE-2026-49134

Indicators of Compromise

• Processes writing to files under /tmp/ or /var/folders/ that match mktemp-style names while a CodexBar installer is active.
• Unexpected bash child processes spawned by sudo, osascript, or macOS authorization helpers during CodexBar installation.
• Root-owned commands executing immediately after a CodexBar administrator prompt that do not match the expected installer logic.

Detection Strategies

• Monitor file write events on temporary directories correlated with CodexBar CLI execution to identify same-user processes modifying installer payloads.
• Track elevation events where bash interprets a temporary file path, and alert on writes to that path between creation and execution.
• Inspect shell command history and audit logs for unusual root-context commands originating from CodexBar installer sessions.

Monitoring Recommendations

• Enable file integrity monitoring on temporary file paths used by privileged installers.
• Forward authorization and sudo logs to a central analytics platform and alert on root commands lacking a corresponding signed installer payload.
• Baseline CodexBar installation behavior on managed endpoints to detect deviations such as unexpected child processes or non-vendor script content.

How to Mitigate CVE-2026-49134

Immediate Actions Required

• Upgrade CodexBar to version 0.32.0 or later on all systems using the GitHub Release v0.32.0.
• Avoid running the CodexBar CLI installer on multi-user systems or systems where untrusted same-user processes may be active.
• Audit endpoints for prior installer runs and verify no unauthorized root-level changes occurred.

Patch Information

The vendor addressed CVE-2026-49134 in CodexBar v0.32.0. The fix is documented in the GitHub Pull Request and committed in dbc944d. The patch removes the race window by changing how the installer constructs and executes its privileged payload.

Workarounds

• Do not invoke the vulnerable CLI installer until the upgrade to 0.32.0 is applied.
• Restrict concurrent process execution on the user account performing the installation to reduce the chance of a race exploit.
• Validate the installer script content out-of-band before approving any administrator prompt issued by older CodexBar versions.

# Verify the installed CodexBar version meets the fixed release
codexbar --version
# Expected output: 0.32.0 or later