CVE-2026-57208: cli < 0.7.7

Affected technology

cli · < 0.7.7
entireio

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

An attacker with push access to the checkpoints repository can craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session directory. Vendor/CNA’s CVSS 4.0 assessment (base score 6.2/10) rates confidentiality and availability impact as none; integrity impact as low.