{"action":"Upgrade @sigstore/oci to 0.7.1 or later.","affected":[{"fixed":"0.7.1","introduced":"0"}],"component":"@sigstore/oci","cve_ids":["CVE-2026-59891"],"ecosystem":"npm","epss":0.00473,"exploited":false,"fixed_versions":["0.7.1"],"ghsa_id":"GHSA-pf56-329r-95rw","id":"tcs_01M5KG3D43RAF33936NYZ1KCSK","modified_at":"2026-07-21T19:45:24.990901157Z","published_at":"2026-07-21T19:34:05Z","references":["https://osv.dev/vulnerability/GHSA-pf56-329r-95rw","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw","https://nvd.nist.gov/vuln/detail/CVE-2026-59891","https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89","https://github.com/sigstore/sigstore-js","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-pf56-329r-95rw","url":"https://osv.dev/vulnerability/GHSA-pf56-329r-95rw"}],"summary":"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry"}