https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:07:44 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-bs35481 <p><strong>Affected:</strong> CleanStart: pulumi, CleanStart: renovate</p> <p>CVE-2026-48758 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: pulumi, CleanStart: renovate</p> <p>CVE-2026-48758 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bs35481 https://cve.radiocsirt.org/vuln/euvd-2026-337879 EUVD-2026-337879 https://cve.radiocsirt.org/vuln/euvd-2026-337879 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48758 <p>sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.</p> <p>sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48758 https://cve.radiocsirt.org/vuln/ghsa-jfc7-64v2-mr8c <p><strong>Affected:</strong> npm: @sigstore/core</p> <p>### Impact The `preAuthEncoding` function in `@sigstore/core` uses Node.js `&#39;ascii&#39;` encoding when converting the PAE (Pre-Authentication Encoding) string to bytes. This allows `payloadType` to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide.</p> <p>In `packages/core/src/dsse.ts`, the PAE function builds a string containing `payloadType` and then encodes it with `Buffer.from(prefix, &#39;ascii&#39;)`.</p> <p>In Node.js, `&#39;ascii&#39;` encoding for string-to-Buffer is equivalent to `&#39;latin1&#39;`, which **truncates characters above U+00FF to their low byte**. This means for any ASCII character, there exist Unicode characters (at U+01xx, U+02xx, etc.) that produce the identical encoded byte:</p> <p>| Original | Codepoint | Mutant | Codepoint | Encoded byte | |----------|-----------|--------|-----------|--------------| | `t` | U+0074 | `Ŵ` | U+0174 | `0x74` | | `e` | U+0065 | `ť` | U+0165 | `0x65` |</p> <p>An attacker can substitute every character in `payloadType` with a Unicode variant whose low byte matches, producing **identical PAE bytes** and a passing signature verification.</p> <p>Additionally, `payloadType.length` returns the JavaScript string length (UTF-16 code units) rather than the UTF-8 byte length required by the DSSE spec, though this is only a contributing factor for non-ASCII types.</p> <p>#### Reproduction</p> <p>```javascript const { preAuthEncoding } = require(&#39;@sigstore/core/dist/dsse.js&#39;); con…</p> <p><strong>Affected:</strong> npm: @sigstore/core</p> <p>### Impact The `preAuthEncoding` function in `@sigstore/core` uses Node.js `&#39;ascii&#39;` encoding when converting the PAE (Pre-Authentication Encoding) string to bytes. This allows `payloadType` to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide.</p> <p>In `packages/core/src/dsse.ts`, the PAE function builds a string containing `payloadType` and then encodes it with `Buffer.from(prefix, &#39;ascii&#39;)`.</p> <p>In Node.js, `&#39;ascii&#39;` encoding for string-to-Buffer is equivalent to `&#39;latin1&#39;`, which **truncates characters above U+00FF to their low byte**. This means for any ASCII character, there exist Unicode characters (at U+01xx, U+02xx, etc.) that produce the identical encoded byte:</p> <p>| Original | Codepoint | Mutant | Codepoint | Encoded byte | |----------|-----------|--------|-----------|--------------| | `t` | U+0074 | `Ŵ` | U+0174 | `0x74` | | `e` | U+0065 | `ť` | U+0165 | `0x65` |</p> <p>An attacker can substitute every character in `payloadType` with a Unicode variant whose low byte matches, producing **identical PAE bytes** and a passing signature verification.</p> <p>Additionally, `payloadType.length` returns the JavaScript string length (UTF-16 code units) rather than the UTF-8 byte length required by the DSSE spec, though this is only a contributing factor for non-ASCII types.</p> <p>#### Reproduction</p> <p>```javascript const { preAuthEncoding } = require(&#39;@sigstore/core/dist/dsse.js&#39;); con…</p> https://cve.radiocsirt.org/vuln/ghsa-jfc7-64v2-mr8c