CVE-2026-118763

The sigstore-js library (specifically the @sigstore/oci package) is vulnerable to credential leakage in versions prior to 0.7.2 . The issue resides in packages/oci/src/registry.ts, where the RegistryClient.signIn() method stores registry Authorization and Docker configuration headers as defaults ...