{"items":[{"id":"NVI-00017830","kind":"vulnerability","title":"turso-cli persists Turso platform JWT with world-readable (0o644) file permissions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-57f6-pvx8-hwj6","CVE-2026-48790"],"plain_summary":"GitHub lists this reviewed advisory for github.com/tursodatabase/turso-cli. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7129fdc9c8cf2fffbc9fe62bf7fdbde6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T20:44:43.000Z","value":"5.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7129fdc9c8cf2fffbc9fe62bf7fdbde6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7129fdc9c8cf2fffbc9fe62bf7fdbde6","url":"https://github.com/advisories/GHSA-57f6-pvx8-hwj6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-57f6-pvx8-hwj6","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:53.922Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7129fdc9c8cf2fffbc9fe62bf7fdbde6"],"technology":"github.com/tursodatabase/turso-cli","known_exclusions":[],"conditions_summary":"### Summary\n\n`turso-cli` persists the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations.\n\n### Impact\n\nThe token in `settings.json` grants the holder full Turso platform access — create or destroy databases, rotate credentials, exfiltrate data, change billing settings — for any organization the user belongs to.\n\nBecause the file is world-readable, the credential is reachable by:\n\n- Cron jobs or daemons running as a different system user on the same host\n- Sandboxed CI runners with a mounted home directory\n- Containers with a bind-mounted host home\n- Co-tenants on a shared multi-user developer or jumpbox host\n\nThe file path resolves through `configdir.LocalConfig(\"turso\")`:\n\n- macOS: `~/Library/Application Support/turso/settings.json`\n- Linux: `~/.config/turso/settings.json` (or `$XDG_CONFIG_HOME/turso/settings.json`)\n\nIt contains the platform JWT in plaintext JSON alongside `organization` and `username` ","public_affected_ranges":["<= 1.0.25"]}],"null_published_at":"2026-11-05T19:10:21.472Z","source_updated_at":"2026-06-26T20:44:43.000Z","source_disclosed_at":"2026-06-26T20:44:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:53.922Z"}],"next_cursor":null,"snapshot_revision":"42594"}