turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48790 · Microsoft / collected KEV context

GHSA-57f6-pvx8-hwj6

GO-2026-5811

cve-program · CVE-2026-48790

• https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6
• https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
• https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
• https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198

nvd · CVE-2026-48790

• https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
• https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
• https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee66f33af3b66
• https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6

osv · GHSA-57f6-pvx8-hwj6

• https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6
• https://github.com/tursodatabase/turso-cli

osv · GO-2026-5811

• https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-hwj6

No related operational record is retained in the current change model.