~ / search / GHSA-xp5g-jhg3-3rg2

GHSA-xp5g-jhg3-3rg2

Double spend in snarkjs

Source: GitHub Advisory Database (reviewed) High CVE-2023-33252

Packages

EcosystemPackageAffectedFixed in
npm snarkjs <= 0.6.11 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.

References

External links from the advisory. They lead to third-party sites.