Executive brief
Sigstore-js is a JavaScript library used to verify the authenticity of software signatures and security certificates. A flaw in the verification process allows an attacker to provide a specially crafted data bundle that manipulates the recorded time of a signature. This could allow an attacker to bypass security checks that ensure a certificate was valid at the time of signing, potentially leading to the acceptance of untrusted or expired software.
Technical details
The @sigstore/verify package within sigstore-js incorrectly derives transparency log timestamps from the 'integratedTime' field for bundle v0.2 inclusionProof-only entries. Because the inclusion proof path does not cryptographically bind this field, an attacker providing an untrusted bundle can manipulate the timestamp. This allows the attacker to influence certificate validity windows and satisfy 'timestampThreshold' verification requirements. The vulnerability is rooted in the library treating 'integratedTime' as a trusted observer timestamp even when it lacks a signed inclusionPromise or set. This issue is resolved in version 3.1.1 by requiring a cryptographically bound time source for these verification decisions.
Affected products
- sigstore sigstore-js (@sigstore/verify) < 3.1.1
Timeline
- 2026-05-22: patched: Fix merged in pull request 1659
- 2026-07-14: disclosed: CVE-2026-48816 published