CVE-2026-48816

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd
https://github.com/sigstore/sigstore-js/pull/1659
https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios de Sigstore. Antes de la 3.1.1, @sigstore/verify deriva una marca de tiempo del registro de transparencia de tlogEntries[].integratedTime para entradas de solo prueba de inclusión del paquete v0.2, a pesar de que la ruta de la prueba de inclusión no vincula criptográficamente integratedTime, permitiendo a un atacante que puede proporcionar un paquete no confiable influir en la validez del certificado y en las decisiones de verificación de timestampThreshold. Este problema se ha solucionado en la versión 3.1.1.

Information

Published : 2026-07-14 21:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-48816

Mitre link : CVE-2026-48816

CVE.ORG link : CVE-2026-48816

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-48816", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48816", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:25:32.204796Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"status": "affected", "version": "< 3.1.1"}]}]}], "published": "2026-07-14T21:17:01.497", "references": [{"url": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-js/pull/1659", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1."}, {"lang": "es", "value": "sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios de Sigstore. Antes de la 3.1.1, @sigstore/verify deriva una marca de tiempo del registro de transparencia de tlogEntries[].integratedTime para entradas de solo prueba de inclusi\u00f3n del paquete v0.2, a pesar de que la ruta de la prueba de inclusi\u00f3n no vincula criptogr\u00e1ficamente integratedTime, permitiendo a un atacante que puede proporcionar un paquete no confiable influir en la validez del certificado y en las decisiones de verificaci\u00f3n de timestampThreshold. Este problema se ha solucionado en la versi\u00f3n 3.1.1."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}