EUVD-2026-44502
GHSA-xgjw-pm74-86q4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attacker must supply the crafted bundle (PR:L); no confidentiality or availability impact; integrity impact is high as certificate validity enforcement is bypassed.
Primary rating from Vendor (https://github.com/sigstore/sigstore-js).
CVSS VectorVendor: https://github.com/sigstore/sigstore-js
Lifecycle Timeline
2Blast Radius
ecosystem impact- 10 npm packages depend on @sigstore/verify (2 direct, 8 indirect)
Ecosystem-wide dependent count for version 3.1.0.
DescriptionCVE.org
sigstore-js derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only (no signed inclusionPromise/set), and the inclusion proof path does not cryptographically bind integratedTime. As a result, an attacker who can supply an untrusted bundle can influence time-based verification decisions by choosing integratedTime.
impact
If a consumer accepts attacker-provided bundle v0.2 inputs and relies on tlog-derived timestamps for certificate validity checks, verification can be influenced by an unauthenticated timestamp value. This is a trust gap: integratedTime is treated as a trusted observer timestamp under inclusionProof-only mode even though only the signed inclusionPromise/set path binds it.
affected code
packages/verify/src/bundle/index.ts(adds a transparency-log timestamp wheneverintegratedTime != 0)packages/verify/src/timestamp/index.ts(convertsintegratedTimeto aDate)packages/verify/src/verifier.ts(verifies timestamps before verifying tlog inclusion)packages/verify/src/tlog/index.ts+packages/verify/src/tlog/set.ts(only the inclusionPromise/set path bindsintegratedTime)
proof of concept
The attached poc.zip contains a self-contained harness that reproduces the behavior on the pinned commit and includes both a canonical test and a negative control.
repro:
- extract
poc.zipinto a fresh directory and run the make targets:
unzip poc.zip -d poc
cd poc/poc-F-SIG-JS-TLOGTIME-001
make canonical
make control- confirm
canonical.logincludes:
[CALLSITE_HIT]:
[PROOF_MARKER]:- confirm
control.logincludes:
[NC_MARKER]:suggested fix
Only treat integratedTime as a trusted timestamp when it is cryptographically bound (for example, via a verified signed inclusionPromise/set). For inclusionProof-only entries, do not count integratedTime toward timestampThreshold, and do not use it for certificate validity decisions unless there is another signed time source (for example, an rfc3161 timestamp).
AnalysisAI
Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity window checks by controlling the integratedTime field in an inclusionProof-only tlog entry. Because the inclusionProof-only code path in @sigstore/verify does not cryptographically bind integratedTime (unlike the signed inclusionPromise/set path), a low-privileged attacker who can present an untrusted bundle can cause the verifier to accept expired or not-yet-valid signing certificates as currently valid. A publicly available proof-of-concept exists; this vulnerability is not in CISA KEV.
Technical ContextAI
sigstore-js is the JavaScript/TypeScript implementation of the Sigstore supply chain signing and verification framework, used broadly in npm-ecosystem CI/CD pipelines. The affected package is @sigstore/verify (pkg:npm/@sigstore_verify). The root cause is CWE-345 (Insufficient Verification of Data Authenticity): in bundle v0.2, a tlog entry may be 'inclusionProof-only' - meaning it carries a Merkle inclusion proof but no signed inclusionPromise or signed entry timestamp (SET). The signed inclusionPromise/SET path cryptographically binds integratedTime via a log-server signature; the inclusionProof-only path does not. The affected code in packages/verify/src/bundle/index.ts unconditionally adds a transparency-log timestamp whenever integratedTime != 0, packages/verify/src/timestamp/index.ts converts it to a Date, and packages/verify/src/verifier.ts uses it for certificate validity and timestampThreshold checks before verifying tlog inclusion. Only packages/verify/src/tlog/set.ts enforces cryptographic binding of integratedTime, and that guard is bypassed in the inclusionProof-only code path.
RemediationAI
The upstream fix described in the advisory is to restrict trust in integratedTime to cases where it is cryptographically bound: only the signed inclusionPromise/set path should contribute integratedTime to timestampThreshold or certificate validity decisions; the inclusionProof-only path must not use integratedTime as a trusted timestamp unless an independent signed time source (e.g., an RFC 3161 timestamp) is also present. The GitHub Security Advisory at https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4 describes this fix, but a specific patched npm release version is not independently confirmed from the provided data - consumers must check the sigstore-js release history for a patched @sigstore/verify version. As a compensating control prior to patching, organizations should avoid passing bundle v0.2 inputs from untrusted or partially-trusted sources to sigstore-js verifiers, and should require bundles to include signed inclusionPromise/set entries rather than accepting inclusionProof-only entries where feasible. Note that restricting accepted bundle formats may break compatibility with bundles generated by older tooling, so testing in staging environments is advised before enforcing this control.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers fo
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provid
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud meta
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, crea
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today