CVE-2026-48816: sigstore sigstore-js
Vulnerability summary
CVE-2026-48816 is a medium (CVSS 6.5) vulnerability in sigstore sigstore-js. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
@sigstore1 product
- verify≥ 3.1.0, < 3.1.1
Chainguard1 product
- pulumi-language-nodejs< 3.248.0-r2
Sigstore1 product
- sigstore-js< 3.1.1
Wolfi1 product
- pulumi-language-nodejs< 3.248.0-r2
4 vendors · 4 products
References
7 links- github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4X Refsource CONFIRMAdvisoryWEB
