Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations.
Version 1.0.26 patches the issue.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L1688
security-advisories@github.com
https://github.com/spf13/viper/blob/v1.21.0/viper.go#L198
security-advisories@github.com
https://github.com/tursodatabase/turso-cli/commit/ffb914849216ef5a86353b3fa6cee…
security-advisories@github.com
https://github.com/tursodatabase/turso-cli/security/advisories/GHSA-57f6-pvx8-h…
security-advisories@github.com