CVE-2026-48758: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48758 is a DSSE (Dead Simple Signing Envelope) payloadType type-binding failure in the @sigstore/core npm package, part of the sigstore-js JavaScript library ecosystem. The vulnerability allows an attacker to mutate the payloadType field of a signed envelope after signing without invalidating the cryptographic signature, breaking the type-binding guarantee that DSSE is designed to enforce. It affects @sigstore/core versions 3.2.0 and earlier, and was fixed in version 3.2.1. The advisory was first published on May 27, 2026, and added to the GitHub Advisory Database on June 26, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory).

The root cause is an improper use of Node.js ascii encoding in the preAuthEncoding function within packages/core/src/dsse.ts (CWE-347: Improper Verification of Cryptographic Signature). In Node.js, ascii encoding is equivalent to latin1, which truncates any character above U+00FF to its low byte — meaning Unicode characters such as U+0174 (Ŵ) and U+0165 (ť) produce the same encoded bytes as their ASCII counterparts t (0x74) and e (0x65). An attacker who can control or intercept a signed DSSE envelope can substitute every character in payloadType with a Unicode variant whose low byte matches the original, producing identical Pre-Authentication Encoding (PAE) bytes and thus a passing signature verification. A secondary issue is that payloadType.length returns the JavaScript UTF-16 code unit count rather than the UTF-8 byte length required by the DSSE specification, further compounding the encoding mismatch for non-ASCII types (Github Advisory, sigstore-js PR #1657).

Successful exploitation allows an attacker to present a DSSE-signed artifact with a forged or substituted payloadType that passes signature verification, undermining the integrity guarantee that DSSE provides for content-type binding. This could enable type confusion attacks where a verifier accepts a payload as a different content type than was originally signed, potentially leading to unauthorized actions in supply chain or artifact verification workflows. Confidentiality is not directly impacted, but integrity and availability are both rated as low per the CVSS assessment, reflecting the limited but real risk of bypassing type-based access controls or policy enforcement in systems relying on sigstore for artifact signing (Github Advisory).

1. Obtain a legitimately signed DSSE envelope: Acquire or intercept a DSSE envelope signed using @sigstore/core <= 3.2.0, where the payloadType field contains standard ASCII characters (e.g., text/plain).
2. Construct a Unicode-substituted payloadType: For each ASCII character in the original payloadType, identify a Unicode character in the U+01xx–U+FFxx range whose low byte matches (e.g., replace t (U+0074) with Ŵ (U+0174), e (U+0065) with ť (U+0165)).
3. Craft the mutant envelope: Replace the payloadType field in the DSSE envelope with the Unicode-substituted string, leaving the signature and payload unchanged.
4. Submit for verification: Present the mutant envelope to a verifier using the vulnerable @sigstore/core library. Because Buffer.from(prefix, 'ascii') truncates Unicode characters to their low bytes, the PAE bytes are identical to the original, and signature verification passes.
5. Achieve type confusion: The verifier now treats the payload as a different content type than was originally signed, potentially bypassing type-based policy enforcement or triggering unintended processing logic (Github Advisory, sigstore-js PR #1657).

• Application Logs: Signature verification events where the payloadType field contains non-ASCII Unicode characters (e.g., characters in the U+0100–U+FFFF range) that visually resemble ASCII MIME types (e.g., ŴeŸŴ/ŰŬšũŮ instead of text/plain).
• Artifact Inspection: DSSE envelopes with payloadType values containing Unicode characters outside the standard ASCII range (U+0000–U+007F) that pass signature verification against an expected ASCII-only type.
• Network: Unexpected or anomalous DSSE envelope submissions to artifact verification endpoints where payloadType contains high-codepoint Unicode characters not consistent with standard MIME types.

Upgrade @sigstore/core to version 3.2.1 or later, which fixes the issue by replacing Buffer.from(prefix, 'ascii') with proper UTF-8 encoding: the payloadType is now encoded as Buffer.from(payloadType, 'utf-8') and its byte length (not JavaScript string length) is used in the PAE calculation (sigstore-js Release, sigstore-js Commit). No configuration-based workaround is available; patching is the only remediation. Projects depending on sigstore-js or packages that bundle @sigstore/core should audit their dependency trees and update accordingly.

The vulnerability was reported by security researchers Str1ckl4nd and Zyy0530, and the fix was authored and merged by sigstore-js maintainer Brian DeHamer (bdehamer) on May 22, 2026 (sigstore-js PR #1657). No significant broader media coverage or notable community commentary beyond the GitHub advisory and pull request discussion has been identified.