CVE-2026-56744
3 advisories.
npm/@bsv/wallet-toolbox CVE-2026-56744: high, EPSS 0.30%
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
Action: Upgrade @bsv/wallet-toolbox to 2.4.0 or later.
npm i @bsv/wallet-toolbox@2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.1.47 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: GHSA-36f9-7rg5-cpf8
- https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8
- https://nvd.nist.gov/vuln/detail/CVE-2026-56744
- https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28
- https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949
- https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b
- https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07
- https://github.com/bsv-blockchain/ts-stack
CVE-2026-56744 · published · modified · JSON
npm/@bsv/wallet-toolbox-client CVE-2026-56744: high, EPSS 0.30%
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
Action: Upgrade @bsv/wallet-toolbox-client to 2.4.0 or later.
npm i @bsv/wallet-toolbox-client@2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.1.47 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: GHSA-36f9-7rg5-cpf8#npm/@bsv/wallet-toolbox-client
- https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8
- https://nvd.nist.gov/vuln/detail/CVE-2026-56744
- https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28
- https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949
- https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b
- https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07
- https://github.com/bsv-blockchain/ts-stack
CVE-2026-56744 · published · modified · JSON
npm/@bsv/wallet-toolbox-mobile CVE-2026-56744: high, EPSS 0.30%
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
Action: Upgrade @bsv/wallet-toolbox-mobile to 2.4.0 or later.
npm i @bsv/wallet-toolbox-mobile@2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.21 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: GHSA-36f9-7rg5-cpf8#npm/@bsv/wallet-toolbox-mobile
- https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8
- https://nvd.nist.gov/vuln/detail/CVE-2026-56744
- https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28
- https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949
- https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b
- https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07
- https://github.com/bsv-blockchain/ts-stack
CVE-2026-56744 · published · modified · JSON