The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
HighVulnerability
GHSA-j63v-mwhm-56jx: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- Identifiers
- CVE-2026-118763GHSA-j63v-mwhm-56jx
- Published
- Record updated
- Affected
- @sigstore/oci <= 0.7.1
- Fixed in
- 0.7.2
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
@sigstore/oci attaches the registry Authorization header as a default on its shared client in signIn(). In uploadBlob(), the blob is PUT to the Location header value returned by the registry without checking that its host matches the registry host, so the credential is sent to any host the registry names. The source describes this as a residual of GHSA-pf56-329r-95rw / CVE-2026-59891, whose fix only changed credential selection in credentials.ts and did not touch registry.ts.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.