Vulnerabilities for sigstore

First version without a known vulnerability: 4.2.0

Details

• GHSA-hm8f-75xx-w2vr2026-01-26

  sigstore CSRF possibility in OIDC authentication during signing

  Fixed in: 4.2.0

• GHSA-hhfg-fwrw-87w72024-12-11

  sigstore has insufficient validation of integration timestamp during verification

  Fixed in: 3.6.0