Detections
Analytics

SCA: security update for @sigstore/oci (GHSA-j63v-mwhm-56jx)

high Tenable Cloud Security Plugin ID 478097

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2,
 packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization
 and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob()
 sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its
 origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user
 pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the
 registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping
 does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed
 redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts
 but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by
 separating registry credentials from client-wide defaults and sending them only to the registry origin.
 (CVE-2026-118763)

Solution

Update the @sigstore/oci library and its related packages to version 0.7.2 or later.

See Also

https://github.com/advisories/GHSA-j63v-mwhm-56jx

Plugin Details

Severity: High

ID: 478097

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.53

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-118763

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-118763

cwe: CWE-522