Technical impact
sigstore-js offers JavaScript bindings for Sigstore services. The API method sigstore.verify() accepted a certificateOIDs parameter, but before version 4.1.1 this option was silently discarded, so the required certificate extension OIDs were never checked. Consequently any certificate that presented a signed artifact could bypass the intended restriction, allowing an attacker to forge or tamper with signatures that the application otherwise intended to reject, thereby compromising the integrity of signed artifacts. The weakness is mapped to CWE‑345 and CWE‑347, both describing improper validation or handling of trusted values.
Affected Systems
All installations of the sigstore sigstore-js library older than version 4.1.1 are affected. Applications consuming sigstore's verify method with the certificateOIDs option are at risk, regardless of the hosting environment or language wrapper used.
Risk and Exploitability
The vulnerability has a CVSS score of 7.5, indicating high severity, but the EPSS score is less than 1 %, suggesting a low probability of exploitation at the moment. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote; an attacker could supply a certificate with inappropriate extensions to the library, cause valid signatures to be accepted, and thereby tamper with signed artifacts or gain trust in malicious content. No elevated privileges or local access are required; the flaw is purely in the verification logic.
Github GHSA