Detections
Analytics

SCA: security update for github.com/anchore/quill (GHSA-7q3q-5px6-4c5p)

medium Tenable Self-Hosted Container Security Plugin ID 438597

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1
 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple
 notarization submission logs. Exploitation requires the ability to modify API responses from Apple's
 notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS
 certificate validation; however, environments with TLS-intercepting proxies (common in corporate
 networks), compromised certificate authorities, or other trust boundary violations are at risk. When
 retrieving submission logs, Quill fetches a URL provided in the API response without validating that the
 scheme is https or that the host does not point to a local or multicast IP address. An attacker who can
 tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS
 requests to attacker-controlled or internal network destinations. This could lead to exfiltration of
 sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and
 library are affected when used to retrieve notarization submission logs. This vulnerability is fixed in
 0.7.1. (CVE-2026-31959)

Solution

Update the github.com/anchore/quill library and its related packages to version 0.7.1 or later.

See Also

https://github.com/advisories/GHSA-7q3q-5px6-4c5p

Plugin Details

Severity: Medium

ID: 438597

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 3/11/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:A/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-31959

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/11/2026

Vulnerability Publication Date: 3/11/2026

Reference Information

CVE: CVE-2026-31959