Skip to content
Verified sigstore-js Insufficient Verification of Data Authenticity
REPRO-2026-00210 sigstore/sigstore-js · github Jul 2, 2026 .txt
Severity MEDIUM
Confidence HIGH
Reproduced in 18m 54s
Tool calls 158
Spend $2.52
Fixed in 3.1.1
$ pruva-verify REPRO-2026-00210
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00210/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

CVE-2026-48816 / GHSA-xgjw-pm74-86q4: Insufficient Verification of Data Authenticity in @sigstore/verify (npm). The verifier derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 and uses it for certificate validity checks and timestampThreshold. In inclusionProof-only entries (no signed inclusionPromise/set), integratedTime is not cryptographically bound, allowing an attacker who supplies a malicious bundle to influence time-based verification decisions.

03 · Root cause
Variant analysis
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.