CVE-2026-49134 is a privilege escalation vulnerability in the steipete CodexBar CLI installer prior to version 0.32.0. The installer creates a temporary file insecurely using mktemp, writes a shell payload, and executes it with elevated privileges. A race condition allows a local attacker with the same user privileges to replace or modify the temporary file before execution, resulting in arbitrary command execution as root. The vulnerability requires local access and user interaction (administrator prompt). The CVSS 4.0 vector indicates network attack vector, high attack complexity, low privileges required, and user interaction needed, with high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker with the same user privileges to escalate to root privileges by executing arbitrary commands as root. This compromises system integrity and confidentiality, potentially allowing full system control. The vulnerability is limited to local users and requires user interaction to approve the administrator prompt. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running the vulnerable installer in untrusted environments or with untrusted users. Limit local user access and monitor for suspicious activity related to installer execution. Do not run the installer with elevated privileges unless necessary.