CVE-2026-48815
High
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSigstore
PublishedJul 14, 2026
First seenJul 14, 2026
Weakness typeCWE-347CWE-347
How to fix
Update
- sigstore4.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sigstorenpm | v < 4.1.1 | 4.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.