{"id":"GHSA-52v5-jr5w-gjxr","revision":null,"records":[{"revision":"40c8477ddc3342c080056f60c0cf2196","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48815","aliases":[],"title":"sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.","state":0,"publishedAt":"2026-07-14T20:27:16.925+00:00","modifiedAt":"2026-07-15T12:56:29.848+00:00","affected":[{"ecosystem":"Vendor product","name":"sigstore-js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sigstore\",\n                    \"product\": \"sigstore-js\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.1.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr","https://github.com/sigstore/sigstore-js/pull/1658","https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b","https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48815","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48815","identifiers":["CVE-2026-48815"]},"retained":false,"historicalAffected":[]},{"revision":"be94074fd6254581aa46f6479286982c","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-48815","aliases":[],"title":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certif…","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.","state":0,"publishedAt":"2026-07-14T21:17:01.37+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b","https://github.com/sigstore/sigstore-js/pull/1658","https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48815","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-347"],"productCriteria":[],"sourceDates":{"published":"2026-07-14T21:17:01.370","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48815","identifiers":["CVE-2026-48815"]},"retained":false,"historicalAffected":[]},{"revision":"acc469d6b8994da39f72803c2f84720e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-52v5-jr5w-gjxr","aliases":["CVE-2026-48815"],"title":"sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced","description":"### Summary\n\nThe documented `certificateOIDs` option in `sigstore.verify()` is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.\n\n### Details\n\nThe public verify options include `certificateOIDs` and the documentation says those OID/value pairs “must be present in the certificate’s extension list.” The policy-construction path used by `sigstore.verify()` and `createVerifier()` only copies the SAN and issuer settings into the verification policy and completely ignores `certificateOIDs`.\n\nAs a result, callers can believe they are constraining verification to certificates carrying specific Fulcio or workload-identifying OIDs, while the actual verifier never receives those constraints. Any bundle that satisfies the remaining checks is accepted even if the required OID extensions are absent or mismatched.\n\nThis is reachable from supported usage through the documented `certificateOIDs` verify option.\n\n### PoC\n\n```javascript\nconst { createVerificationPolicy } = require(\"sigstore/dist/config\");\n\nconst policy = createVerificationPolicy({\n  certificateIssuer: \"https://issuer.example\",\n  certificateIdentityEmail: \"victim@example.com\",\n  certificateOIDs: {\n    \"1.2.3.4\": \"required-value\",\n  },\n});\n\nconsole.log(\"certificateOIDs\" in policy, JSON.stringify(policy));\n// false {\"subjectAlternativeName\":\"victim@example.com\",\"extensions\":{\"issuer\":\"https://issuer.example\"}}\n```\n\n### Impact\n\nApplications that rely on `certificateOIDs` to restrict which certificates may sign artifacts receive no such protection. Unauthorized certificates that should be rejected on extension policy can be accepted as long as they satisfy the remaining verification checks.","state":0,"publishedAt":"2026-07-01T19:58:28+00:00","modifiedAt":"2026-09-10T03:50:12.2625419+00:00","affected":[{"ecosystem":"npm","name":"sigstore","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.1.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr","https://github.com/sigstore/sigstore-js"],"sourceUrl":"https://github.com/advisories/GHSA-52v5-jr5w-gjxr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-52v5-jr5w-gjxr","identifiers":["GHSA-52v5-jr5w-gjxr","CVE-2026-48815"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:27.2118469+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:27.2119981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-aabe25475865c7edee522f4302371edf7f08f4ba2936ed86dd9f3eab30c8198d","complete":true,"records":414888,"lastAttemptAt":"2026-10-27T09:09:26.1888005+00:00","lastSuccessAt":"2026-10-27T09:00:39.8201567+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.1888005+00:00","snapshotPublishedAt":"2026-10-27T08:33:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T09:09:33.2115253+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:30.438867+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:30.4388678+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f1de7fa5541453e964c3923e20a9f35","complete":true,"records":13416,"lastAttemptAt":"2026-10-27T09:09:31.2124779+00:00","lastSuccessAt":"2026-10-27T09:03:12.991+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:03:12.991+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T09:09:26.6530761+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.6530761+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T09:09:26.4482482+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.4482482+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T09:09:26.7642122+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.7642122+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-513066461af8d030bad8efab4fea81eabd246acd525512aa7469c95ccf02c320","complete":true,"records":230813,"lastAttemptAt":"2026-10-27T09:09:26.5496184+00:00","lastSuccessAt":"2026-10-27T09:02:44.9044939+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.5496184+00:00","snapshotPublishedAt":"2026-10-27T08:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}