notaryproject — Vulnerabilities & Security Advisories 7

Notaryproject is an open-source software supply chain security framework designed to verify software integrity through cryptographic signatures. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, as evidenced by its seven recorded CVEs. The platform's security model relies on cryptographic verification but has faced implementation weaknesses that allow attackers to bypass signature checks or inject malicious code. While no major public security incidents have been widely reported, the consistent discovery of critical vulnerabilities in its codebase highlights ongoing challenges in maintaining secure software verification processes.