Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31839Striae has a hash validation utility vulnerability

High 8.2

In plain English

A high-severity security flaw in striae from striae-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.1%top 96.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@striae-org/striae	3.0.0	GHSA-mmf8-487q-p45m

Affected products (as reported)

Vendor	Product	Versions
striae-org	striae	>= 0.9.22-0, < 3.0.0

Weakness: CWE-354 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/striae-org/striae/security/advisories/GHSA-mmf8-487q-p45m x_refsource_CONFIRM
https://github.com/striae-org/striae/releases/tag/v3.0.0 x_refsource_MISC