{"id":"GHSA-57f6-pvx8-hwj6","revision":null,"records":[{"revision":"f51871a054184b95bada181f58827b55","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48790","aliases":[],"title":"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions","description":"Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.","state":0,"publishedAt":"2026-08-11T17:25:27.457+00:00","modifiedAt":"2026-08-12T22:13:40.373+00:00","affected":[{"ecosystem":"Vendor product","name":"turso-cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tursodatabase\",\n                    \"product\": \"turso-cli\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.0.26\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6","https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66","https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688","https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48790","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48790","identifiers":["CVE-2026-48790"]},"retained":false,"historicalAffected":[]},{"revision":"fb48c42b86a24cf089602703e7ad05e7","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-48790","aliases":[],"title":"Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential …","description":"Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue.","state":0,"publishedAt":"2026-08-11T18:17:34.167+00:00","modifiedAt":"2026-10-23T21:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688","https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198","https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66","https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48790","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-276","CWE-732"],"productCriteria":[],"sourceDates":{"published":"2026-08-11T18:17:34.167","lastModified":"2026-10-23T21:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48790","identifiers":["CVE-2026-48790"]},"retained":false,"historicalAffected":[]},{"revision":"8f44e6e0ca19409da323b19e5ff67286","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-57f6-pvx8-hwj6","aliases":["CVE-2026-48790","GO-2026-5811"],"title":"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions","description":"### Summary\n\n`turso-cli` persists the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations.\n\n### Impact\n\nThe token in `settings.json` grants the holder full Turso platform access — create or destroy databases, rotate credentials, exfiltrate data, change billing settings — for any organization the user belongs to.\n\nBecause the file is world-readable, the credential is reachable by:\n\n- Cron jobs or daemons running as a different system user on the same host\n- Sandboxed CI runners with a mounted home directory\n- Containers with a bind-mounted host home\n- Co-tenants on a shared multi-user developer or jumpbox host\n\nThe file path resolves through `configdir.LocalConfig(\"turso\")`:\n\n- macOS: `~/Library/Application Support/turso/settings.json`\n- Linux: `~/.config/turso/settings.json` (or `$XDG_CONFIG_HOME/turso/settings.json`)\n\nIt contains the platform JWT in plaintext JSON alongside `organization` and `username` fields.\n\nComparable CLIs (`gh`, `aws`, `docker`, `gcloud`, plus close peers `planetscale`, `neon`, `upstash`) write credential files at `0o600` explicitly, so this is a deviation from the cross-vendor baseline rather than a deliberate trade-off.\n\n### Details\n\nThe OAuth callback handler stores the platform JWT via the settings layer:\n\n```go\n// internal/cmd/auth.go:205-214\njwt, err := callbackServer.Result()\n...\nsettings.SetToken(jwt)\n```\n\n`SetToken` writes through Viper:\n\n```go\n// internal/settings/settings.go:124-127\nfunc (s *Settings) SetToken(token string) {\n    viper.Set(\"token\", token)\n    s.changed = true\n}\n```\n\nPersistence runs through `viper.WriteConfig`:\n\n```go\n// internal/settings/settings.go:96-101\nfunc TryToPersistChanges() error {\n    if err := viper.WriteConfig(); err != nil {\n        return fmt.Errorf(\"failed to persist turso settings file: %w\", err)\n    }\n    return nil\n}\n```\n\nViper v1.21.0 (pinned in `turso-cli` `go.mod`) initializes `configPermissions` to `os.FileMode(0o644)` at `viper.go:198` and passes that mode straight to `os.OpenFile` at `viper.go:1688`. Without a call to `viper.SetConfigPermissions(0o600)`, the resulting `settings.json` is created at `0o644`.\n\nA `grep` over the auth-config write path under `internal/` returns zero hits for `Chmod`, `0o600`, or `0600`, confirming there is no follow-up tightening of the file mode anywhere on the persistence path.\n\n### Proof of concept\n\nMinimal reproducer using the same Viper version `turso-cli` pins (`github.com/spf13/viper v1.21.0`):\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"os\"\n    \"path/filepath\"\n\n    \"github.com/spf13/viper\"\n)\n\nfunc main() {\n    dir, _ := os.MkdirTemp(\"\", \"viperpoc-*\")\n    defer os.RemoveAll(dir)\n\n    viper.SetConfigName(\"settings\")\n    viper.SetConfigType(\"json\")\n    viper.AddConfigPath(dir)\n\n    viper.Set(\"token\", \"FAKE_TURSO_JWT_xxxxxxxxxxxxxxxxxxxx\")\n    viper.Set(\"organization\", \"exampleorg\")\n    viper.SafeWriteConfig()\n\n    st, _ := os.Stat(filepath.Join(dir, \"settings.json\"))\n    fmt.Printf(\"mode: %o\\n\", st.Mode()&0o777)\n}\n```\n$ go run main.go mode: 644\n\nThe same `SafeWriteConfig` / `WriteConfig` calls `turso-cli` uses produce the same `0o644` mode in a real `turso auth login` flow.\n\n### Remediation\n\nOne-line fix at the existing Viper configuration site in `internal/settings/settings.go` (around lines 48-50):\n\n```go\nviper.SetConfigName(\"settings\")\nviper.SetConfigType(\"json\")\nviper.AddConfigPath(configPath)\nviper.SetConfigPermissions(0o600) // restrict settings.json to owner only\n```\n\nDefense in depth:\n\n- Add `os.Chmod(configFile, 0o600)` after `TryToPersistChanges`, or on read (as PlanetScale does in `internal/config/config.go` — they `Stat` the token file and self-heal if `Mode() &^ 0o600` is nonzero).  `viper.SetConfigPermissions` applies only on file creation, so an existing wider-mode file is not tightened otherwise.\n- Add `os.Chmod(configPath, 0o700)` after `configdir.MakePath(configPath)` (line 43) to close the equivalent gap on the enclosing directory, which is otherwise created under the default umask.\n\nPatch: https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66\n\n### Workarounds\n\nUntil upgraded, users can tighten the existing files manually:\n\n```sh\n# Linux\nchmod 600 ~/.config/turso/settings.json\nchmod 700 ~/.config/turso\n\n# macOS\nchmod 600 \"$HOME/Library/Application Support/turso/settings.json\"\nchmod 700 \"$HOME/Library/Application Support/turso\"\n```\n\nThis must be repeated after any operation that recreates the file (e.g.\n`turso auth login`) until the patched version is installed.\n\n### Resources\n\n- Patch commit: https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66\n- Viper `configPermissions` default: https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198\n- Viper write path: https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688\n- CWE-276: https://cwe.mitre.org/data/definitions/276.html\n- CWE-732: https://cwe.mitre.org/data/definitions/732.html","state":0,"publishedAt":"2026-06-26T20:44:39+00:00","modifiedAt":"2026-07-07T16:11:34.7536414+00:00","affected":[{"ecosystem":"Go","name":"github.com/tursodatabase/turso-cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.26"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6","https://github.com/tursodatabase/turso-cli"],"sourceUrl":"https://github.com/advisories/GHSA-57f6-pvx8-hwj6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-57f6-pvx8-hwj6","identifiers":["GHSA-57f6-pvx8-hwj6","CVE-2026-48790","GO-2026-5811"]},"retained":false,"historicalAffected":[]},{"revision":"869ce1929d484faeb194038c35f058f2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5811","aliases":["CVE-2026-48790","GHSA-57f6-pvx8-hwj6"],"title":"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli","description":"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:01:34.716928+00:00","affected":[{"ecosystem":"Go","name":"github.com/tursodatabase/turso-cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.26"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5811","license":"OSV · upstream source license applies","key":"osv:GO-2026-5811","identifiers":["GO-2026-5811","CVE-2026-48790","GHSA-57f6-pvx8-hwj6"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T17:37:18.9351244+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T17:37:18.9351244+00:00","lastSuccessAt":"2026-10-26T17:37:19.151471+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:19.1514719+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-d6f206810bfc698eadf8f28407d530f4767f368cd89e94211e8dccb68eba0455","complete":true,"records":414339,"lastAttemptAt":"2026-10-26T17:35:34.9653803+00:00","lastSuccessAt":"2026-10-26T17:35:34.8568888+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:35:34.9653803+00:00","snapshotPublishedAt":"2026-10-26T17:28:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T17:37:46.9178053+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":2564,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T17:37:18.9351244+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T17:37:18.9351244+00:00","lastSuccessAt":"2026-10-26T17:37:19.1522283+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:19.1522304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-141ff4fb146e4923a19e7481870bbe2d","complete":false,"records":13416,"lastAttemptAt":"2026-10-26T17:37:44.6767196+00:00","lastSuccessAt":"2026-10-26T17:37:44.673+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:44.673+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T17:37:18.6945274+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:18.6945274+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T17:35:35.1091889+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:35:35.1091889+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T17:37:18.8871755+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:18.8871755+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-278d5002a4c49eb0a53aa603d1ea0cbe27ac563f4fab7dbdf3bbdb9c900730cf","complete":true,"records":230811,"lastAttemptAt":"2026-10-26T17:37:18.5499294+00:00","lastSuccessAt":"2026-10-26T17:37:17.1540989+00:00","error":null,"lastVerifiedAt":"2026-10-26T17:37:18.5499294+00:00","snapshotPublishedAt":"2026-10-26T16:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}