in-toto vulnerable to Configuration Read From Local Directory

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

• CVE-2023-32076: 0.24% estimated exploitation activity in the next 30 days; percentile 15.58 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification [1]. Among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems [2] and security issues have been discovered in their implementations as well [3]. We found in our conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, we decided to drop support for `in_totorc`.

Other Recommendations Sandbox functionary code as recommended in…

Published by the source

11 May 2023, 20:47 UTC

Last modified by the source

4 Feb 2026, 04:31 UTC

Source last checked

24 Oct 2026, 04:13 UTC

1. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-wc64-c5rv-32pf

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2023-32076

Advisory: in-toto vulnerable to Configuration Read From Local Directory
IDs: CVE-2023-32076, GHSA-wc64-c5rv-32pf
Record: https://patchnext.com/advisories/cve-2023-32076 (revision 1, source checked 24 Oct 2026, 04:13 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: in-toto 2.0.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI in-toto: affected < 2.0.0; fixed in 2.0.0

## Suggested inspection (read-only)
- `python -m pip show in-toto`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on in-toto.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-wc64-c5rv-32pf (OSV record GHSA-wc64-c5rv-32pf lists affected ranges: PyPI in-toto >=0 <2.0.0 (fixed))

Commands are suggestions: review each one before running it.