CVE-2026-48816

{
  "id": "CVE-2026-48816",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T21:17:01.497",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1."
    },
    {
      "lang": "es",
      "value": "sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios de Sigstore. Antes de la 3.1.1, @sigstore/verify deriva una marca de tiempo del registro de transparencia de tlogEntries[].integratedTime para entradas de solo prueba de inclusión del paquete v0.2, a pesar de que la ruta de la prueba de inclusión no vincula criptográficamente integratedTime, permitiendo a un atacante que puede proporcionar un paquete no confiable influir en la validez del certificado y en las decisiones de verificación de timestampThreshold. Este problema se ha solucionado en la versión 3.1.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sigstore",
          "product": "sigstore-js",
          "versions": [
            {
              "version": "< 3.1.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T14:25:32.204796Z",
          "id": "CVE-2026-48816",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/sigstore-js/pull/1659",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}