Medium severity · published Jul 14, 2026
CVE-2026-48758
sigstore-js: DSSE payloadType type-binding failure
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
sigstore-js · sigstore
< 3.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48758
github.com
https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7
github.com
https://github.com/sigstore/sigstore-js/pull/1657
github.com
https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1
github.com
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c
More from sigstore-js
9.6
CVE-2026-59891
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
7.5
CVE-2026-48815
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
6.5
CVE-2026-48816
sigstore-js: Insufficient Verification of Data Authenticity