@sigstore/core@2.0.0 vulnerability (CVE-2026-48758 / GHSA-jfc7-64v2-mr8c) not patchable via npm overrides due to shrinkwrap

[VivienLeonhardt]

Current Behavior

@ui5/cli@4.0.59 ships with its own package-lock.json shrinkwrap, which pins
@sigstore/core to 2.0.0 internally. npm ignores workspace-root overrides for packages
inside a hasShrinkwrap: true dependency, so the following override has no effect on
the nested instance:

"overrides": {
"@sigstore/core": "4.0.1"
}

The vulnerable instance remains at:
node_modules/@ui5/cli/node_modules/@sigstore/core@2.0.0

This is flagged as Moderate severity by OSC/Black Duck security scanning.

Steps to Reproduce the Issue

1. Add @ui5/cli@4.0.59 to dependencies
2. Add "@sigstore/core": "4.0.1" to overrides in package.json
3. Run npm install
4. Run cat node_modules/@ui5/cli/node_modules/@sigstore/core/package.json | grep
   '"version"'
5. Observe "version": "2.0.0" — override was ignored

Context

• UI5 Module Version: 4.0.59
  • Node.js Version: v22.22.3
  • npm Version: 10.9.8
  • OS/Platform: macOS Darwin 25.5.0
  • Other: Flagged by OSC/Black Duck security scanning — CVE-2026-48758 /
    GHSA-jfc7-64v2-mr8c — @sigstore/core <=3.2.0 vulnerable to improper cryptographic
    signature verification via Unicode character substitution in preAuthEncoding. Patched
    in @sigstore/core@3.2.1.

Log Output / Stack Trace

$ cat node_modules/@ui5/cli/node_modules/@sigstore/core/package.json | grep
'"version"'
"version": "2.0.0",

The fix is to update @sigstore/core to >=3.2.1 in @ui5/cli's own package-lock.json
(or upgrade the sigstore dependency to a version that ships @sigstore/core@4.x).

[matz3]

Hi @VivienLeonhardt,

Thank you for bringing that up.
We are aware of this finding and have already analysed whether it is applicable to our usage in UI5 CLI, which is not the case.
Please see our comments in our audit checks, where we described why the vulnerability is not applicable:

cli/audit-ci.jsonc

Lines 6 to 12 in 0e158d8

	// @ui5/project uses only pacote.packument(), pacote.manifest(), and pacote.extract()
	// with verifySignatures/verifyAttestations left at their default false.
	// Neither the vulnerable sigstore.verify() path nor the DSSE preAuthEncoding code is
	// reachable through our call sites, so neither advisory is exploitable via @ui5/project.
	"GHSA-jfc7-64v2-mr8c|@sigstore/sign>@sigstore/core",
	"GHSA-jfc7-64v2-mr8c|@sigstore/verify>@sigstore/core",
	"GHSA-jfc7-64v2-mr8c|@ui5/cli>@ui5/project>pacote>sigstore>@sigstore/core"

We have already upgraded to pacote v21 on our main branch, which upgrades to a higher sigstore version.
This will be part of the upcoming UI5 CLI v5 release.

However, we are currently unable to resolve the audit finding for UI5 CLI v4, as upgrading to @sigstore/core v3.2.1 would require raising our minimum required Node.js version, which is a breaking change.

We are aware of the fact that npm does not allow overriding versions on consumer side when the package is using npm-shrinkwrap.
This is why the proposed and attempted solution does not work.

For SAP customers, also see SAP KBA 3781989 (requires login).

I hope this helps.

Matthias