Apprite CLI makes Use of Hard-coded Credentials

MEDIUM 5.5CVE-2023-50974 · GHSA-g777-crp9-m27g · PYSEC-2024-2 · Published 09/01/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
appwrite PyPI	`< 3.0.0`	`3.0.0`
command line interface appwrite	`< 3.0.0`	`3.0.0`
appwrite-cli npm	`< 3.0.0`	`3.0.0`

Description

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-50974 · ADVISORY
appwrite.io/docs/tooling/command-line/installation · WEB
gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d · WEB
appwrite/sdk-for-cli · PACKAGE
pypa/advisory-database · WEB
GitHub Advisory GHSA-g777-crp9-m27g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free