JavaScript Library Vulnerability in Sigstore Services by Sigstore

CVE-2026-118763

What is CVE-2026-118763?

Sigstore-js provides JavaScript libraries that allow interaction with Sigstore services. A vulnerability exists prior to version 0.7.2 where the RegistryClient.signIn() method inadvertently stores sensitive credentials such as registry Authorization and Docker configuration headers on a shared HTTP client. This can lead to unauthorized access if a malicious registry directs users to a harmful endpoint. The RegistryClient.uploadBlob() method can be exploited by sending a new PUT request to an absolute blob-upload location, potentially exposing authentication headers to an attacker’s server. This issue originated as a residual from a previous vulnerability that did not sufficiently restrict the origins of credential requests. The issue has been resolved in version 0.7.2, which improves the handling of registry-specific credentials and enforces origin constraints.

References