Skip to content
OpenAdvisories

Package · npm

@sigstore/oci

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.4
    CVE-2026-118763

    @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a share…

    sigstore sigstore-js @sigstore/oci npm
  • Critical 9.6
    CVE-2026-59891 Public exploit

    Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regis…

    sigstore sigstore-js @sigstore/oci npm