Vulnerability in Sigstore Sigstore-Js
CVE-2026-48758
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
EPSS: 0.003 (18.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Sigstore Sigstore-js — versions < 3.2.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-48758?
- CVE-2026-48758 is a medium-severity vulnerability in Sigstore Sigstore-Js, classified under Improper Verification of Cryptographic Signature. CVSS score: 5.4/10. Published 2026-07-14.
- How severe is CVE-2026-48758?
- Medium severity. CVSS v3 base score is 5.4 out of 10.