Vulnerability Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd1
- https://github.com/sigstore/sigstore-js/pull/1658
- https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1
- https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
- https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
FAQ
What is CVE-2026-48815?
CVE-2026-48815 is a vulnerability with a CVSS score of 7.5 (HIGH). sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded...
How severe is CVE-2026-48815?
CVE-2026-48815 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48815?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.