Beveiligingsadvies

CVE-2026-48815

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-14 20:27:16

Laatst bijgewerkt 2026-07-15 12:56:29

Toegewezen door GitHub_M

CVSS-score 7.5

Status PUBLISHED

Beschrijving

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

← Alle CVE's bekijken Bekijk op cve.org ↗