PT-2026-24744 · Npm+3 · @Striae-Org/Striae+1
Stephen Jlu
·
Publicado
2026-03-11
·
Atualizado
2026-03-12
·
CVE-2026-31839
CVSS v3.1
8.2
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Striae versions prior to 3.0.0
Description
Striae is a firearms examiner's comparison companion. A high-severity integrity bypass issue existed in the digital confirmation workflow. The validation process relied on hash values from the package manifest, which could be altered alongside the package content. This allowed manipulated confirmation packages to pass integrity checks. The issue affects users who depend on digital confirmations for immutability and chain-of-custody control. An attacker with access to an exported package could modify confirmation data and recalculate hashes, bypassing hash-only checks.
Recommendations
Upgrade to version 3.0.0 or later.
Treat hash-only validation as a tamper indicator, not proof of immutability.
Restrict package exchange to trusted authenticated internal channels.
Require out-of-band reviewer attestation for sensitive confirmation workflows.
Pause imports from untrusted sources until upgraded.
Exploit
Correção
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
@Striae-Org/Striae
Striae