The vulnerability in sigstore-js (before 3.1.1) involves insufficient verification of data authenticity (CWE-345) in the @sigstore/verify component. Specifically, for bundle v0.2 inclusionProof-only entries, the transparency-log timestamp is derived from tlogEntries[].integratedTime, which is not cryptographically bound by the inclusion proof path. This flaw enables an attacker who can supply an untrusted bundle to manipulate certificate validity and timestampThreshold verification decisions. The problem is resolved in version 3.1.1.

An attacker capable of supplying a malicious bundle can influence the verification process of certificates and timestamps, potentially causing the system to accept invalid or manipulated certificates. This undermines the integrity of the verification process but does not directly impact confidentiality or availability. The CVSS score of 6.5 (medium severity) reflects the moderate impact with network attack vector, low attack complexity, and limited privileges required.

Upgrade to sigstore-js version 3.1.1 or later, where this vulnerability is fixed. Since no official patch advisory is provided beyond this version information, users should verify they are running version 3.1.1 or newer to ensure the issue is resolved. No other mitigations are specified.