vulnti.work

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checki…

严重 CVSS 9.6
CVECVE-2026-59891
首次发现2026-07-15 21:16 UTC
披露时间2026-07-14 17:17 UTC
最后更新2026-07-15 21:16 UTC
通道状态auto

摘要

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured…

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判 · 自动通道

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD