Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Quill Fails to Validate Apple Notarization Log URL
GHSA-7q3q-5px6-4c5p
CVE-2026-31959
Summary
Quill, a tool used for macOS notarization, is at risk if it's used in certain network environments. An attacker could potentially trick Quill into sending sensitive data to an unauthorized location. Upgrade to version v0.7.1 to fix this issue.
What to do
- Update github.com anchore to version 0.7.1.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| github.com | anchore | <= 0.7.1 | 0.7.1 |
Original title
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval
Original description
### Impact
Quill before version `v0.7.1` contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.
When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.
### Patches
Fixed in Quill version `v0.7.1`
### Workarounds
None
### Credit
Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability
### Resources
- [Apple Get Submission Log API Documentation](https://developer.apple.com/documentation/notaryapi/get-submission-log)
Quill before version `v0.7.1` contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.
When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.
### Patches
Fixed in Quill version `v0.7.1`
### Workarounds
None
### Credit
Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability
### Resources
- [Apple Get Submission Log API Documentation](https://developer.apple.com/documentation/notaryapi/get-submission-log)
ghsa CVSS3.1
5.3
Vulnerability type
CWE-20
Improper Input Validation
CWE-918
Server-Side Request Forgery (SSRF)
- https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p
- https://github.com/anchore/quill/commit/e41d66a517c2dc20ad8e9fbccffbdc6ba5ef0020
- https://developer.apple.com/documentation/notaryapi/get-submission-log
- https://github.com/anchore/quill/releases/tag/v0.7.1
- https://github.com/advisories/GHSA-7q3q-5px6-4c5p
- https://nvd.nist.gov/vuln/detail/CVE-2026-31959
Published: 11 Mar 2026 · Updated: 13 Mar 2026 · First seen: 11 Mar 2026