Read the docs
TI-2021-17929 Aliases CVE-2021-41087GHSA-vrxp-mg9f-hwf3

Improperly Implemented path matching for in-toto-golang

Priority LOW 29CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.

Why it matters now

EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed in-toto-golang (in-toto): 0.3.0github.com/in-toto/in-toto-golang (Go): 0.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
in-totoin-toto-golangbefore 0.3.00.3.0Patch availableCNA
—github.com/in-toto/in-toto-golang (Go)before 0.3.00.3.0Patch availableGHSA-vrxp-mg9f-hwf3
  • in-toto-golang Vendorin-toto Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA
  • github.com/in-toto/in-toto-golang (Go) Vendor— Affected before 0.3.0 Fixed in 0.3.0 Patch available GHSA-vrxp-mg9f-hwf3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:in-toto:in-toto-golang:*:*:*:*:*:*:*:*before 0.3.0Vulnerablein-toto
  • cpe:2.3:a:in-toto:in-toto-golang:*:*:*:*:*:*:*:* Versions before 0.3.0 Vulnerable ·in-toto

Remediation

  • Fix · CNA in-toto-golang (in-toto) Fixed in 0.3.0
  • Fix · GHSA-vrxp-mg9f-hwf3 github.com/in-toto/in-toto-golang (Go) Fixed in 0.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41087
  2. 2026-10-03 Alias added: GHSA-vrxp-mg9f-hwf3

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences