{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.61.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "nono-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.61.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T15:51:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/\u003cnamespace\u003e/\u003cpack\u003e/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack \u0027always-further/claude\u0027 has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack \u0027always-further/claude\u0027 has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull \u003cnamespace\u003e/\u003cpack\u003e --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.",
  "id": "GHSA-hc4m-q9jh-xw4j",
  "modified": "2026-07-28T15:51:30Z",
  "published": "2026-07-28T15:51:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/always-further/nono"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nolabs-ai/nono/releases/tag/v0.62.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nono-cli\u0027scregistry pack verification can fail open when provenance metadata is absent"
}