Apache-2.0
All Versions
Vulnerabilities (Public)
Known vulnerabilities and security issues detected in the extension's dependencies and code.
| Vulnerability ID | Advisory | Affected Versions | |||
|---|---|---|---|---|---|
| CVE-2026-24408 | Affected versions of the sigstore package are vulnerable to Cross-Site Request Forgery (CSRF) due to missing validation of the OAuth “state” parameter returned in the authentication response. The sigs… | Medium | – | – | <4.2.0 |
| CVE-2024-55655 | Versions of sigstore-python newer than 2.0.0 but before 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration … | Low | – | – | >=2.0.0,<3.6.0 |
Safety Discovered Vulnerabilities
Additional security issues found by Safety, exclusive to our platform.