Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@sigstore/verify

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5npmAmendedPublished

    sigstore-js has Insufficient Verification of Data Authenticity

    CVE-2026-48816 · GHSA-xgjw-pm74-86q4

    Affected
    • npm @sigstore/verify >= 3.1.0, <= 3.1.0
    Fixed in
    3.1.1· Vendor fix available
    Issue
    sigstore-js derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only (no signed inclusionPromise/set), and the inclusion proof path does not cryptographically bind integratedTime. As a result, an attacker who can supply an untrusted bundle can influence time-based verification decisions by choosing integratedTime. impact If a consumer accepts attacker-provided bundle v0.2 inputs and relies on tlog-derived timestamps for certificate validity checks, verification can be influenced by an unauthenticated timestamp value. This is a trust gap: integratedTime is treated as a trusted observer timestamp under inclusionProof-only mode even though only the signed inclusionPromise/set path binds it. affected code - packages/verify/src/bundle/index.ts (adds a transparency-log timestamp whenever integratedTime != 0) -…

    Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →