sigstore-js CVE-2026-59891

Exploitation requires all of the following: (1) the victim has valid Docker registry credentials stored in their Docker config file that getRegistryCredentials() reads; (2) an attacker-controllable target registry hostname exists that has a substring relationship with one of those configured auth keys - either the target is a substring of a configured key (e.g. 'cr.io' within 'ghcr.io') or a configured key is a substring of the target (e.g. '127.0.0.1:5000' within 'victim.127.0.0.1:5000'); and (3) the victim is induced to run a sigstore-js/@sigstore/oci operation (push/pull of signing artifacts) against that attacker-named registry (UI:R - user/pipeline interaction is required). Limiting factors: the flaw is not exploitable without a pre-existing configured credential that happens to be substring-compatible with an attacker-chosen name, and it requires the victim to actively target the attacker's registry, so it is not a passive, fully-automatic exposure. Authentication to the victim's own registry is not required of the attacker (PR:N), but the victim must have credentials configured for the substring-related registry.

The signals conflict and warrant scrutiny. The published CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the described behavior is fundamentally a credential-disclosure bug (CWE-522), so the I:H and A:H components appear overstated - the direct, primary impact on the vulnerable system is confidentiality (leaked credentials), with integrity/availability harm only as a downstream, second-order consequence if the stolen credentials are reused. AC:L is also debatable: successful exploitation requires that a substring relationship happen to exist between an attacker-controllable registry name and a credential the victim has actually configured, plus victim interaction (UI:R) to run the operation against the attacker's registry - conditions that argue for higher attack complexity. No EPSS score was provided, this is not in CISA KEV (no confirmed active exploitation), and no POC was supplied - only the fixing commit and release. Net: this is a genuine supply-chain credential-hygiene flaw worth prompt patching in any pipeline using @sigstore/oci, but the real-world risk is materially lower than the 9.6 implies; treat it as a moderate-priority patch rather than an emergency, and verify the inflated I/A metrics against your own threat model.

An attacker publishes or names a registry whose hostname has a substring relationship with a registry the victim has authenticated to (for example the attacker controls 'cr.io' while the victim has stored credentials for 'ghcr.io', or the attacker uses 'victim.127.0.0.1:5000' where the victim configured '127.0.0.1:5000'). The attacker then induces the victim's CI/build pipeline or developer to run a sigstore-js OCI operation targeting the attacker's registry; because selection is a substring match, the victim's real ghcr.io credentials are sent to the attacker's endpoint. No public POC was provided, but the fixing commit's added tests concretely demonstrate the substring-collision cases, and the AV:N/UI:R vector means exploitation is network-based but hinges on getting the victim to run the operation.