Welcome to Inedo Security Labs
Established in 2023, we're a team of security researchers that work closely with Inedo's product engineers, solution architects, and leadership to improve Software Supply Chain Security for our customers and beyond. We accomplish this through research (some of which is published in our SecLib), as well as advisory and consulting services.
We also curate the ProGet Vulnerability Database (PGVD), which is an aggregation of publicly-disclosed vulnerabilities from a variety of sources and malicious packages we've detected.
Latest Vulnerabilities Detected
| PVRS Category | Vulnerability ID | Summary | Package |
|---|
 | PGV-2636300 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. | |
 | PGV-2635757 | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1. | |
| PGV-2635756 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3. | |
| PGV-2635755 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0. | |
| PGV-2635754 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0. | |
Meet the Inedo Security Labs Team
We're a small but focused team that reports directly to Inedo's CEO, Alex Papadimoulis. Our experience is diverse and over a range of domains and technologies, from Java in the banking sector to legacy Windows systems in mining, and advancements in cloud-native and machine learning. And although we're new to the Inedo team, we started with a ton of experience in Inedo's products.
Our Analysts
Pete Barnum
Senior Security Analyst
Pete has a background in regulatory compliance, with a focus on cybersecurity, SDLC auditing, risk management, disaster recovery, and IT vendor management. He's worked the Banking, Logistics, and Government sectors... but not yet the live/traveling entertainment industry.
Kim Pento
Chief Security Researcher
As Chief Security Researcher at Inedo Security Labs, Kim leverages her 20 years of expertise in cybersecurity in highly regulated sectors, oversees the team, and was a key figure alongside Alex Papadimoulis, CEO of Inedo, in the establishment of Inedo Security Labs.
Tod Hoven
Security Analyst
Tod is a former product engineer of ProGet transitioned into a career as a security researcher. Interested in analyzing and dissecting various software and systems to discover potential vulnerabilities and threats, vulnerability assessment, penetration testing, and threat modeling.