Homepage

Improper Handling of Inconsistent Special Elements Affecting github.com/in-toto/in-toto-golang/in_toto package, versions <0.11.0

Severity

 Recommended
0.0
low
0
10

CVSS assessment by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMINTOTOINTOTOGOLANGINTOTO-16624583
  • published10 May 2026
  • disclosed8 May 2026
  • creditOleh Konko
Report a new vulnerability Found a mistake?

Introduced: 8 May 2026

CVE NOT AVAILABLE CWE-168  (opens in a new tab)

How to fix?

Upgrade github.com/in-toto/in-toto-golang/in_toto to version 0.11.0 or higher.

Overview

Affected versions of this package are vulnerable to Improper Handling of Inconsistent Special Elements due to inconsistent handling of negation operators in glob pattern processing. An attacker can cause unintended rule matching or bypass intended restrictions by crafting layouts that are interpreted differently across implementations.

Note: This is only exploitable when two different implementations are used to verify the same layout and attestation bundle at different stages of the same pipeline.

CVSS Base Scores

version 4.0
version 3.1