Executive brief
Striae is a digital confirmation and package integrity system used to maintain forensic records and proof of immutability. Prior to version 3.0.0, attackers with access to exported confirmation packages could modify both the package contents and hash values to bypass integrity checks, allowing tampered packages to be accepted as authentic. This undermines the system's core purpose as a chain-of-custody control for sensitive confirmations.
Technical details
A hash validation utility in Striae prior to v3.0.0 trusted manifest hash fields without cryptographic verification, allowing hash-only validation to be bypassed through a classic integrity check weakness (CWE-327, CWE-353, CWE-354). An attacker with local access to an exported confirmation package can modify both the package contents and recompute the hash values, allowing tampered packages to pass hash-only integrity checks because both the hash and content exist in the same mutable trust boundary. The vulnerability affects Striae versions 0.9.22-0 through 2.x.x. Fix: Upgrade to v3.0.0 or later, which implements server-issued asymmetric signatures, canonical payload signature verification, and fail-closed behavior for missing/invalid signature metadata.
Affected products
- Striae Striae >=0.9.22-0, <3.0.0
Timeline
- 2026-03-11: disclosed: Published as GHSA-mmf8-487q-p45m and CVE-2026-31839
- 2026-03-11: patched: Patched in v3.0.0