{"action":"Upgrade signify to 0.9.2 or later.","affected":[{"fixed":"0.9.2","introduced":"0"}],"component":"signify","cve_ids":["CVE-2025-70887"],"ecosystem":"PyPI","epss":0.00349,"exploited":false,"fixed_versions":["0.9.2"],"ghsa_id":"GHSA-p4hh-mq57-gq8x","id":"tcs_01M5KGYGJZD76N4H2P0F35FQ1B","modified_at":"2026-07-13T16:45:07.904915460Z","published_at":"2026-03-25T19:16:28.130Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2278","https://github.com/mtrojnar/osslsigncode/releases/tag/2.11","https://github.com/mtrojnar/osslsigncode/issues/475","https://github.com/ralphje/signify/issues/60","https://github.com/mtrojnar/osslsigncode/pull/477","https://github.com/ralphje/signify/commit/64f21c0cc06cea0536370686ca3ba7a01e4adaa8","https://github.com/advisories/GHSA-p4hh-mq57-gq8x"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2278","url":"https://osv.dev/vulnerability/PYSEC-2026-2278"}],"summary":"An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signed_data.py and the context.py components"}