{"action":"Upgrade nono-cli to 0.61.3 or later.","affected":[{"fixed":"0.61.3","introduced":"0"}],"component":"nono-cli","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.61.3"],"ghsa_id":"GHSA-hc4m-q9jh-xw4j","id":"tcs_01M5KF0F7KD7HDPHB0VJJ44B9J","modified_at":"2026-07-28T16:00:25.007445276Z","published_at":"2026-07-28T15:51:30Z","references":["https://osv.dev/vulnerability/GHSA-hc4m-q9jh-xw4j","https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j","https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87","https://github.com/always-further/nono","https://github.com/nolabs-ai/nono/releases/tag/v0.62.0"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-hc4m-q9jh-xw4j","url":"https://osv.dev/vulnerability/GHSA-hc4m-q9jh-xw4j"}],"summary":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent"}