CVE-2026-48815

highCVSS 7.5covered by 1 sourcefirst seen 2026-07-14

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

⚡ Watch CVE-2026-48815

Get an email if CVE-2026-48815 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-48815: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1…nvd · 2026-07-14

External references

NVD record for CVE-2026-48815

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-48815 status](https://www.csirts.com/badge/CVE-2026-48815)](https://www.csirts.com/cve/CVE-2026-48815)