Executive brief
Gitsign is a tool used to digitally sign and verify Git commits using secure identities like GitHub. A flaw in how the tool handles certain malformed signatures causes it to crash internally and then incorrectly report a successful verification to the operating system. This could allow an attacker to bypass security checks in automated systems, such as CI/CD pipelines or scripts, that rely on the tool's exit code to confirm that a commit is authentic.
Technical details
A vulnerability exists in Gitsign's `CertVerifier.Verify()` function within `pkg/git/verifier.go`. The code unconditionally dereferences the first element of the certificate slice (`certs[0]`) returned by `GetCertificates()` without checking if the slice is empty. An attacker can provide a CMS/PKCS7 signed message with an empty certificate set, which is structurally valid DER but causes an index-out-of-range panic. Because the panic is caught by a recovery function in `internal/io/streams.go` that returns a `nil` error, the application exits with code 0. Consequently, any automated tools or scripts that rely solely on the process exit code will interpret a failed/crashed verification as a success. This is fixed in version 0.15.0.
Affected products
- Sigstore Gitsign >= 0.4.0, < 0.15.0
Timeline
- 2026-05-04: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: NVD publication date