PT-2026-58289 · Npm · Sigstore-Js

CVE-2026-59891 · Published 2026-07-14 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 0.7.1

Description The getRegistryCredentials() function reads credentials from the Docker config file and selects an entry by checking if any configured auth key contains the target registry string. Due to the use of a substring match instead of an exact host match, credentials intended for one registry may be incorrectly selected and transmitted to a different registry if its hostname shares a substring relationship with a configured auth key.

Recommendations Update to version 0.7.1.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-59891

GHSA-PF56-329R-95RW

Affected Products

Sigstore-Js

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59891.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-59891 · Security Note
• https://osv.dev/vulnerability/CVE-2026-59891 · Vendor Advisory
• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw · Note
• https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89 · Note
• https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1 · Note