CyberRota Analysis
AI-GeneratedThe vulnerability affects the preAuthEncoding function in the @sigstore/core library, which improperly uses Node.js ASCII encoding, allowing the payloadType to be altered post-signing without invalidating the signature. This undermines the type-binding guarantee intended by the Digital Signature Submission Envelope (DSSE) framework, potentially leading to unauthorized modifications. Developers using versions prior to 3.2.1 should prioritize upgrading to mitigate the risk of payload manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.