CVE-2026-48815

7.5 Élevée

Publiée le 14/07/2026 à 23:17 · Modifiée le 15/07/2026 à 22:23 · Analyse NVD reportée · Source : security-advisories@github.com

Description

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

Traduire en français

Produits concernés

sigstore-js

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-347

Références

https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b
https://github.com/sigstore/sigstore-js/pull/1658
https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories