CVE-2026-59891
1 advisory.
npm/@sigstore/oci CVE-2026-59891: critical 9.6
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Action: Upgrade @sigstore/oci to 0.7.1 or later.
npm i @sigstore/oci@0.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.7.1 | - |
Fixed versions
| 0.7.1 |
Sources
- osv: GHSA-pf56-329r-95rw
- https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw
- https://nvd.nist.gov/vuln/detail/CVE-2026-59891
- https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89
- https://github.com/sigstore/sigstore-js
- https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1
CVE-2026-59891 · published · modified · JSON