Technical impact
The vulnerability in sigstore-js allows an attacker to read registry credentials from a Docker config file and provide them to a malicious registry through a substring match bug. When getRegistryCredentials() is called, the function examines all configured auth entries and selects one whose hostname contains the target registry string as a substring. This means credentials stored for a legitimate registry can be inadvertently chosen for a different registry whose hostname includes the legitimate hostname, exposing sensitive credentials. The CWE-522 flaw results in accidental disclosure of registry authentication data.
Affected Systems
The flaw affects the sigstore-js library, specifically versions prior to 0.7.1. The affected product is reported by the CNA as sigstore:sigstore-js, and the vulnerability was fixed in release 0.7.1. Users employing sigstore-js for interacting with Sigstore services should verify that they are on version 0.7.1 or newer, as earlier releases remain vulnerable.
Risk and Exploitability
The CVSS score of 9.6 places this vulnerability in the critical range. The EPSS score of less than 1% suggests that exploitation events are expected to remain rare, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the nature of the flaw—exposing registry credentials to an attacker‑controlled registry—makes it especially dangerous for environments that rely on private container registries. An attacker could retrieve privileged credentials by directing the library to a malicious registry whose hostname contains a substring of a legitimate registry. The substring-matching logic provides a straightforward path to exploit without requiring advanced techniques, meaning the risk is high for affected deployments.
Github GHSA