GHSA-7q3q-5px6-4c5p

Suggest an improvement
Source
https://github.com/advisories/GHSA-7q3q-5px6-4c5p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-7q3q-5px6-4c5p/GHSA-7q3q-5px6-4c5p.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7q3q-5px6-4c5p
Aliases
Published
2026-03-11T00:37:44Z
Modified
2026-03-17T05:11:17Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval
Details

Impact

Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.

When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.

Patches

Fixed in Quill version v0.7.1

Workarounds

None

Credit

Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability

Resources

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:37:44Z",
    "nvd_published_at": "2026-03-11T20:16:16Z",
    "severity": "MODERATE"
}
References

Affected packages

Go / github.com/anchore/quill

Package

Name
github.com/anchore/quill
View open source insights on deps.dev
Purl
pkg:golang/github.com/anchore/quill

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-7q3q-5px6-4c5p/GHSA-7q3q-5px6-4c5p.json"