Executive brief
A vulnerability in gitsign, a tool used for signing and verifying Git commits, allows malformed commits to appear as if they have a valid signature when they actually contain different content than what Git displays. An attacker could craft a commit that passes verification but executes different code or contains different files than what the user sees. This undermines the trust in signed commits and could lead to the distribution of malicious code that appears to be endorsed by a trusted developer.
Technical details
The vulnerability exists in gitsign's verification logic where it re-encodes commit and tag objects using go-git's EncodeWithoutSignature before verification. Because go-git performs 'loose parsing,' it handles malformed objects with duplicate headers (like 'tree') differently than standard git-core. Specifically, git-core uses the first occurrence of a header while go-git uses the last. An attacker can craft a commit with two tree headers where the signature matches the second tree (seen by gitsign) but the actual content used by Git is the first tree. This allows for signature replay attacks and causes a mismatch between the verified signature and the actual repository content. The issue is fixed in version 0.16.0.
Affected products
- sigstore gitsign < 0.16.0
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-05-08: other: CVE published
References
- https://api.github.com/users/bugbunny-research
- https://github.com/bugbunny-research
- https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D
- https://api.github.com/users/bugbunny-research/repos
- https://avatars.githubusercontent.com/u/262839898?v=4
- https://api.github.com/users/bugbunny-research/events%7B/privacy%7D