CVE-2026-48816: sigstore-js has Insufficient Verification of Data Authenticity

July 1, 2026

sigstore-js derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only (no signed inclusionPromise/set), and the inclusion proof path does not cryptographically bind integratedTime. As a result, an attacker who can supply an untrusted bundle can influence time-based verification decisions by choosing integratedTime.

References

github.com/advisories/GHSA-xgjw-pm74-86q4
github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4
nvd.nist.gov/vuln/detail/CVE-2026-48816

Code Behaviors & Features

Detect and mitigate CVE-2026-48816 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →