GHSA-g32c-4pvp-769g

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possib

Medium highest severity reported · also known as CVE-2026-31960

1
catalog tools match this advisory
0
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
No
in the CISA KEV catalog
0.1%
EPSS for CVE-2026-31960, percentile 0

Catalog tools matching GHSA-g32c-4pvp-769g

ToolVersion scannedPackageFixed inReleased binaryDeclared in or found inDispute
kube-linter
Kubernetes Security
v0.8.3github.com/anchore/quill@v0.5.1
golang
0.7.1not in released binarytool-imports/go.modDispute
kube-linter
Kubernetes Security
v0.8.3github.com/anchore/quill@v0.5.1
golang
0.7.1not in released binarytool-imports/go.modDispute

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

GitHub advisory GHSA-g32c-4pvp-769g · NVD CVE-2026-31960 · OSV GHSA-g32c-4pvp-769g

Grype data sources: https://github.com/advisories/GHSA-g32c-4pvp-769g · https://nvd.nist.gov/vuln/detail/CVE-2026-31960