{"action":"Upgrade @bsv/wallet-toolbox to 2.4.0 or later.","affected":[{"fixed":"2.4.0","introduced":"1.1.47"}],"component":"@bsv/wallet-toolbox","cve_ids":["CVE-2026-56744"],"ecosystem":"npm","epss":0.00383,"exploited":false,"fixed_versions":["2.4.0"],"ghsa_id":"GHSA-36f9-7rg5-cpf8","id":"tcs_01M5KEW73A48TYJ28QR8YMG3V4","modified_at":"2026-09-24T19:45:04.829800715Z","published_at":"2026-09-24T19:32:00Z","references":["https://osv.dev/vulnerability/GHSA-36f9-7rg5-cpf8","https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8","https://nvd.nist.gov/vuln/detail/CVE-2026-56744","https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28","https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949","https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b","https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07","https://github.com/bsv-blockchain/ts-stack"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-36f9-7rg5-cpf8","url":"https://osv.dev/vulnerability/GHSA-36f9-7rg5-cpf8"}],"summary":"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction"}