sigstore-js CVE-2026-48816

Exploitation requires two simultaneous conditions: (1) the application accepts bundle v0.2 format inputs that are attacker-supplied or attacker-modifiable - bundles fetched from fully trusted, integrity-protected sources are not affected if the attacker cannot tamper with them in transit or at rest; and (2) the verifier relies on tlog-derived timestamps (the integratedTime field from tlogEntries[]) for certificate validity window checks or to satisfy timestampThreshold. The vulnerable code path is activated only when the tlog entry is inclusionProof-only - lacking a signed inclusionPromise or signed entry timestamp (SET) - which is a permitted state in bundle v0.2. Exploitation is NOT possible via the signed inclusionPromise/SET path because that path cryptographically binds integratedTime to a log-server signature. The CVSS PR:L metric indicates some level of access or privilege is required to supply the crafted bundle to the target verifier.

The provided CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects a medium-severity finding with high integrity impact. No EPSS score is available from the provided data; this vulnerability is not in CISA KEV, meaning active widespread exploitation is not confirmed. A proof-of-concept (poc.zip) is confirmed publicly available via the GitHub advisory, raising the real-world exploitation likelihood above baseline. Practically, exploitation is gated on the attacker's ability to supply or tamper with the bundle presented to the verifier - an attacker who cannot influence bundle contents cannot trigger the flaw. In CI/CD pipelines that fetch bundles from artifact registries or content-addressable stores where the attacker has write access, the exploitation surface is meaningful. The integrity impact is supply-chain-critical: accepting an expired certificate as valid can allow signed artifacts produced after certificate expiry to pass verification, undermining the core trust guarantee of Sigstore. The tags 'Microsoft' and 'Canonical' in the metadata appear misattributed and do not align with the vulnerability scope; the 'Information Disclosure' tag is similarly misleading - this is an integrity bypass, not a disclosure issue. Real priority is moderate-to-high for organizations using sigstore-js with v0.2 bundles from partially-trusted sources.

An attacker with write access to an artifact registry or the ability to intercept a bundle download crafts a bundle v0.2 with a tlog entry in inclusionProof-only mode and sets integratedTime to a value that falls within the validity window of an already-expired signing certificate. When the sigstore-js verifier processes this bundle, it trusts the attacker-supplied integratedTime as the log-observed timestamp, causes the certificate validity check to pass, and accepts the bundle as validly signed despite the certificate being expired. A self-contained proof-of-concept (poc.zip) demonstrating this behavior on a pinned commit is publicly linked in the GitHub Security Advisory GHSA-xgjw-pm74-86q4.