{"action":"Upgrade signify to 0.9.2 or later.","affected":[{"fixed":"0.9.2","introduced":"0"}],"component":"signify","cve_ids":["CVE-2025-70887"],"ecosystem":"PyPI","epss":0.00349,"exploited":false,"fixed_versions":["0.9.2"],"ghsa_id":"GHSA-p4hh-mq57-gq8x","id":"tcs_01M5KFSA3Q4AHA20YG6NGGECSR","modified_at":"2026-07-13T07:26:12.884060538Z","published_at":"2026-03-25T21:30:35Z","references":["https://osv.dev/vulnerability/GHSA-p4hh-mq57-gq8x","https://nvd.nist.gov/vuln/detail/CVE-2025-70887","https://github.com/mtrojnar/osslsigncode/issues/475","https://github.com/ralphje/signify/issues/60","https://github.com/mtrojnar/osslsigncode/pull/477","https://github.com/ralphje/signify/commit/64f21c0cc06cea0536370686ca3ba7a01e4adaa8","https://github.com/mtrojnar/osslsigncode/releases/tag/2.11","https://github.com/ralphje/signify"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-p4hh-mq57-gq8x","url":"https://osv.dev/vulnerability/GHSA-p4hh-mq57-gq8x"},{"source":"nvd","source_id":"CVE-2025-70887","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70887"}],"summary":"Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components"}