CVE-2026-44310

A flaw was found in Gitsign, a tool used for signing Git commits with a GitHub or OIDC OpenID Connect identity. A remote attacker could craft a specially designed signed message that contains an empty certificate set. This malformed message would cause Gitsign's verification process to silently...

Gitsign input validation error vulnerability

Gitsign is a tool developed by Gitsign’s developers that allows for signing Git commits without the need for a key. Versions of Gitsign from 0.4.0 to 0.15.0 contained a vulnerability related to input validation errors. This vulnerability stemmed from the CertVerifier.Verify method, which...