Executive brief
Capgo CLI is a tool used by developers to manage app deployments and build credentials. In versions before 12.128.2, the tool fails to properly check for symbolic links when writing sensitive configuration files. This allows a malicious project or repository to trick a developer into overwriting important system files or exposing private signing credentials to other users on the same machine.
Technical details
Capgo CLI before 12.128.2 is vulnerable to multiple file handling issues. First, the 'login' and 'build credentials' commands follow symbolic links without validation when writing '.capgo' and '.capgo-credentials.json' files. An attacker can place malicious symlinks in a repository that, when processed by the CLI, cause arbitrary file overwrites with attacker-controlled content (such as API keys or JSON data). Second, the CLI creates global credential files with world-readable permissions (mode 664), potentially exposing sensitive signing materials like Android keystores and iOS certificates on shared systems. These issues are addressed in version 12.128.2 by implementing symlink checks and enforcing stricter file permissions (0600).
Affected products
- Capgo cli < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published
- 2026-06-21: disclosed: CVE published to NVD