PT-2026-37206 · Go · Github.Com/Supply-Chain-Tools/Gitverify

Published 2026-04-24 · Updated 2026-04-24

OSV

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

gitverify is still a prototype.

Impact

The bug is related to requireSignedTags which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor.

Patches

Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet).

Workarounds

No

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

GHSA-H829-5CG7-6HFF

Affected Products

Github.Com/Supply-Chain-Tools/Gitverify

References · 4

• https://osv.dev/vulnerability/GHSA-h829-5cg7-6hff · Vendor Advisory
• https://github.com/supply-chain-tools/gitverify · Note
• https://github.com/supply-chain-tools/gitverify/commit/c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 · Note
• https://github.com/supply-chain-tools/gitverify/security/advisories/GHSA-h829-5cg7-6hff · Note