CVE-2026-31959

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs. This vulnerability is fixed in 0.7.1.

• CWE-918

• https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5pVendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31953Xibo is an open source digital signage platform with a web c…5.4
• CVE-2026-31954Emlog is an open source website building system. In 2.6.6 an…7.3
• CVE-2026-31955Xibo is an open source digital signage platform with a web c…4.9
• CVE-2026-31956Xibo is an open source digital signage platform with a web c…4.3
• CVE-2026-31957Himmelblau is an interoperability suite for Microsoft Azure …10
• CVE-2026-31958Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-3196An integer overflow vulnerability was found in the virtio-sn…5.5
• CVE-2026-31960Quill provides simple mac binary signing and notarization fr…5.3
• CVE-2026-31961Quill provides simple mac binary signing and notarization fr…5.5
• CVE-2026-31962HTSlib is a library for reading and writing bioinformatics f…8.8
• CVE-2026-31963HTSlib is a library for reading and writing bioinformatics f…8.1
• CVE-2026-31964HTSlib is a library for reading and writing bioinformatics f…7.5