CVE-2026-31959

{"id": "CVE-2026-31959", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2026-03-11T20:16:16.777", "references": [{"url": "https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs. This vulnerability is fixed in 0.7.1."}, {"lang": "es", "value": "Quill proporciona firma binaria de mac y notarizaci\u00f3n simple desde cualquier plataforma. Quill antes de la versi\u00f3n v0.7.1 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) al intentar obtener los registros de env\u00edo de notarizaci\u00f3n de Apple. La explotaci\u00f3n requiere la capacidad de modificar respuestas de la API del servicio de notarizaci\u00f3n de Apple, lo cual no es posible bajo condiciones de red est\u00e1ndar debido a HTTPS con validaci\u00f3n adecuada de certificados TLS; sin embargo, entornos con proxies de intercepci\u00f3n TLS (comunes en redes corporativas), autoridades de certificaci\u00f3n comprometidas, u otras violaciones de l\u00edmites de confianza est\u00e1n en riesgo. Al recuperar los registros de env\u00edo, Quill obtiene una URL proporcionada en la respuesta de la API sin validar que el esquema sea https o que el host no apunte a una direcci\u00f3n IP local o de multidifusi\u00f3n. Un atacante que puede manipular la respuesta puede proporcionar una URL arbitraria, haciendo que el cliente de Quill emita peticiones HTTP o HTTPS a destinos de red controlados por el atacante o internos. Esto podr\u00eda llevar a la exfiltraci\u00f3n de datos sensibles como credenciales de proveedores de la nube o respuestas de servicios internos. Tanto la CLI de Quill como la biblioteca se ven afectadas cuando se usan para recuperar los registros de env\u00edo de notarizaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 0.7.1."}], "lastModified": "2026-03-16T19:24:00.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anchore:quill:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1436F241-3681-40EF-825B-6E7F91E2042B", "versionEndIncluding": "0.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}