CVE-2023-50974: 
JavaScript vulnerability analysis and mitigation

In Appwrite CLI before version 3.0.0, a security vulnerability was discovered where user credentials stored in the ~/.appwrite/prefs.json file had overly permissive UNIX permissions (0644). This allowed any local system user to access the stored Appwrite credentials (NVD, Exploit).

The vulnerability stems from improper file permissions management when storing authentication credentials. When using the login command, the CLI stores user credentials in ~/.appwrite/prefs.json with UNIX permissions set to 0644, making the file readable by all users on the system. The CVSS v3.1 base score is 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows any local user on the system to read the contents of the preferences file, potentially exposing Appwrite authentication credentials. This could lead to unauthorized access to the Appwrite instance and its resources (NVD, Exploit).

The vulnerability has been fixed in Appwrite CLI version 3.0.0. Users should upgrade to this version or later. The fix involves setting more restrictive file permissions (0600) for the preferences file, allowing only the file owner to read and write to it (NVD).