VDB
GHSA-7pcg-jhjm-w87w
GHSA-7pcg-jhjm-w87w
PUBLISHED
CVSS 5.5 MEDIUM
Record from GitHub Advisory Database · Published March 25, 2026
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Risk scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Timeline
- Mar 25, 2026 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-7pcg-jhjm-w87w
vulnetix vdb fixes GHSA-7pcg-jhjm-w87wOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-7pcg-jhjm-w87w/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://support.apple.com/en-us/126346 url
- https://support.apple.com/en-us/126349 url
- https://support.apple.com/en-us/126794 url
- https://support.apple.com/en-us/126796 url
- https://nvd.nist.gov/vuln/detail/CVE-2026-20694 advisory
- https://support.apple.com/en-us/126348 url
- https://support.apple.com/en-us/126350 url
- https://support.apple.com/en-us/126795 url