8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31839

CVE-2026-31839: Striae has a hash validation utility vulnerability

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31839

CVE-2026-31839:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@striae-org/striae	npm	>= 0.9.22-0, < 3.0.0	3.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-31839, is an integrity bypass in Striae's digital confirmation workflow. The root cause was an insecure method of integrity validation. Confirmation packages were protected only by a SHA256 hash embedded within the package's metadata. An attacker with access to an exported package could alter the confirmation data, recalculate the hash of the modified content, and replace the original hash. The system would then validate the tampered data as authentic because the hash matched the content.

The patch, released in v3.0.0, addresses this by implementing a robust cryptographic signing mechanism. The new workflow involves a server-side component that signs the confirmation data with a private key upon export (signConfirmationData). When the data is imported (importConfirmationData) or manually verified (HashUtility), the system now checks for a valid signature using a public key (verifyConfirmationSignature). This ensures that any modification to the data after it was signed will cause the signature verification to fail, thus preventing the integrity bypass. The vulnerable functions are those that were involved in either creating the insecurely hashed packages (exportConfirmationData) or those that processed them and relied on the insufficient hash check (importConfirmationData, validateConfirmationHash, HashUtility).

Vulnerable functions

importConfirmationData

app/components/actions/case-import/confirmation-import.ts

This function is responsible for importing confirmation data. In the vulnerable version, it only validated the integrity of the data using a hash (`validateConfirmationHash`). An attacker could modify the confirmation data and simply recalculate the hash, allowing the tampered data to pass validation. The patch adds a call to `validateConfirmationSignatureFile` to verify a cryptographic signature, preventing this bypass.

validateConfirmationHash

app/components/actions/case-import/validation.ts

This function was the sole method of integrity validation for confirmation data before the patch. It calculates the SHA256 hash of the data and compares it to the hash stored in the metadata. The vulnerability is that this check is insufficient, as an attacker controlling the file can modify both the content and the hash. The function itself is not flawed in its implementation but represents the weak security control that was bypassed.

exportConfirmationData

app/components/actions/confirm-export.ts

This function was responsible for creating the confirmation data packages. In the vulnerable version, it would only compute a SHA256 hash and embed it in the metadata. It did not apply a cryptographic signature, which meant the exported files lacked tamper-proofing and could be modified by an attacker who could then re-calculate the hash to match the new content.

HashUtility

app/components/sidebar/hash/hash-utility.tsx

This React component provides a manual file verification utility. Before the patch, it only checked the file's hash against the `hash` field in the metadata, giving a false sense of security for tampered confirmation files. An attacker could provide a modified file, and this utility would report it as valid. The patch adds a call to `verifyConfirmationSignature` to ensure the file's authenticity is also checked.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.