CVE-2026-48758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48758", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T19:39:05.356Z", "datePublished": "2026-07-14T20:36:28.641Z", "dateUpdated": "2026-07-15T12:54:55.445Z"}, "containers": {"cna": {"title": "sigstore-js: DSSE payloadType type-binding failure", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"}, {"name": "https://github.com/sigstore/sigstore-js/pull/1657", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/pull/1657"}, {"name": "https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7"}, {"name": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"version": "< 3.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:36:28.641Z"}, "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1."}], "source": {"advisory": "GHSA-jfc7-64v2-mr8c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T12:54:43.124124Z", "id": "CVE-2026-48758", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T12:54:55.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48758", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:54:43.124124Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T12:54:28.824Z"}}], "cna": {"title": "sigstore-js: DSSE payloadType type-binding failure", "source": {"advisory": "GHSA-jfc7-64v2-mr8c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"status": "affected", "version": "< 3.2.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c", "name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-js/pull/1657", "name": "https://github.com/sigstore/sigstore-js/pull/1657", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7", "name": "https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1", "name": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:36:28.641Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48758", "state": "PUBLISHED", "dateUpdated": "2026-07-15T12:54:55.445Z", "dateReserved": "2026-05-22T19:39:05.356Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T20:36:28.641Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-js", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 3.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1."}, {"lang": "es", "value": "sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios Sigstore. Antes de la 3.2.1, la funci\u00f3n preAuthEncoding en @sigstore/core utiliza la codificaci\u00f3n ascii de Node.js al convertir la cadena PAE a bytes, permitiendo que payloadType sea mutado despu\u00e9s de la firma sin invalidar la firma y rompiendo la garant\u00eda de vinculaci\u00f3n de tipo que DSSE est\u00e1 dise\u00f1ado para proporcionar. Este problema est\u00e1 solucionado en la versi\u00f3n 3.2.1."}], "id": "CVE-2026-48758", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48758", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T12:54:43.124124Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:01.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/pull/1657"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sigstore-core: @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding", "id": "2499686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499686"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in the @sigstore/core component. The preAuthEncoding function incorrectly uses Node.js 'ascii' encoding when converting Pre-Authentication Encoding (PAE) strings to bytes. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE)."], "mitigation": {"lang": "en:us", "value": "Upgrade to @sigstore/core 3.2.1 or later."}, "name": "CVE-2026-48758", "public_date": "2026-06-26T19:11:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48758\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48758\nhttps://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"], "statement": "A flaw was found in @sigstore/core. The preAuthEncoding function uses Node.js ASCII encoding which truncates Unicode characters to their low byte, allowing payloadType to be mutated after signing without invalidating the DSSE signature.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "sigstore-js", "source": "cna", "vendor": "sigstore"}, "product": "sigstore", "vendor": "sigstore"}], "created": "2026-07-16T13:15:04.198568+00:00", "updated": "2026-08-01T09:15:03.332078+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore"]}