Technical impact
The vulnerability resides in the Python implementation of Signify, affecting all releases prior to version 0.9.2. A remote attacker can manipulate the signed_data.py and context.py modules to perform a privilege escalation, which aligns with the CWE‑269 classification. By altering signed data handling, the attacker may obtain elevated permissions within the system, potentially allowing them to execute arbitrary code with higher privileges.
Affected Systems
The affected product is Signify, distributed under the Python package ralphje:signify. All versions before 0.9.2 are vulnerable; no other vendors or product versions are listed.
Risk and Exploitability
The vulnerability is scored highly with a CVSS value of 8.8, indicating significant potential impact. Exploit likelihood appears low, and it is not currently recorded as a known exploited vulnerability in the public catalog. The flaw is likely triggered by a remote actor who can provide crafted signed data to the vulnerable components, enabling the privilege escalation path described above.
Github GHSA