Skip to content
OpenAdvisories

Package · npm

@sigstore/oci

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-118763

    @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a share…

    sigstore sigstore-js @sigstore/oci npm