@sigstore/oci vulnerabilities
CVEs whose affected-version data names the @sigstore/oci package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118763High· 7.4@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
▾ Twilightsigstore · @sigstore/ociEPSS 0.30%via GHSA
CVE-2026-59891Critical· 9.6PoCCredential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
▾ Abyssalsigstore · @sigstore/ociEPSS 0.47%via GHSA