slsa-framework vulnerabilities

Products

• github.com/slsa-framework/slsa-verifier/v2 1

Latest slsa-framework CVEs

Newest publication first

1. GHSA-r2xv-vpr2-42m9 slsa-verifier vulnerable to mproper validation of npm's publish attestations

   Published 2023-11-08

   Unknown

   Summary slsa-verifier<=2.4.0 does not correctly verify npm's publish attestations signature. Proof of concept Steps to reproduce: curl -Sso attestations.json $(npm view @trishankatdatadog/supreme-goggles --json | jq -r '.dist.attestations.url') curl -Sso supreme-goggles.tgz "$(np...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.