{"action":"Upgrade anchor-lang to 1.0.2 or later.","affected":[{"fixed":"1.0.2","introduced":"1.0.0"}],"component":"anchor-lang","cve_ids":["CVE-2026-45137"],"ecosystem":"crates.io","epss":0.0028,"exploited":false,"fixed_versions":["1.0.2"],"ghsa_id":"GHSA-c6rc-8jpp-2fgc","id":"tcs_01M5KEWR24KE6JJPP3B9CV1X1Q","modified_at":"2026-06-09T00:00:17.857926165Z","published_at":"2026-05-13T15:31:49Z","references":["https://osv.dev/vulnerability/GHSA-c6rc-8jpp-2fgc","https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc","https://github.com/solana-foundation/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc","https://nvd.nist.gov/vuln/detail/CVE-2026-45137","https://github.com/solana-foundation/anchor","https://github.com/solana-foundation/anchor/releases/tag/v1.0.2","https://rustsec.org/advisories/RUSTSEC-2026-0144.html"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-c6rc-8jpp-2fgc","url":"https://osv.dev/vulnerability/GHSA-c6rc-8jpp-2fgc"}],"summary":"Anchor: Program<'info, System> is not properly validated"}