Executive brief
CodexBar is a tool used for managing AI providers and release workflows. A security flaw in its release process allowed local users on the same computer to steal sensitive App Store Connect API keys or interfere with software build files. This could lead to the theft of developer credentials or the unauthorized modification of software before it is submitted to Apple for notarization.
Technical details
A vulnerability exists in the `Scripts/sign-and-notarize.sh` script of CodexBar due to the use of predictable temporary file paths in the `/tmp` directory. Specifically, the script writes the `APP_STORE_CONNECT_API_KEY_P8` secret to a fixed path (`/tmp/codexbar-api-key.p8`) and stages notarization archives at a predictable location. A local attacker can exploit this by pre-creating symbolic links or monitoring the directory to capture the API key or redirect file writes. This allows for the theft of App Store Connect credentials and potential tampering with notarization archives before they are submitted to Apple. The issue is resolved in version 0.32.0 by using `mktemp -d` to create isolated, restricted-permission workspaces.
Affected products
- steipete CodexBar < 0.32.0
Timeline
- 2026-05-30: patched: Fix merged in pull request 1228
- 2026-05-31: advisory: Version 0.32.0 released
- 2026-06-01: disclosed: CVE published and NVD entry created