{"action":"Upgrade anchor-lang to 1.0.2 or later.","affected":[{"fixed":"1.0.2","introduced":"1.0.0"}],"component":"anchor-lang","cve_ids":["CVE-2026-45137"],"ecosystem":"crates.io","epss":0.0028,"exploited":false,"fixed_versions":["1.0.2"],"ghsa_id":"GHSA-c6rc-8jpp-2fgc","id":"tcs_01M5KFBG670DYG2P6Y39G0165W","modified_at":"2026-10-12T18:00:13.559737310Z","published_at":"2026-05-07T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0144","https://crates.io/crates/anchor-lang","https://rustsec.org/advisories/RUSTSEC-2026-0144.html","https://github.com/solana-foundation/anchor/commit/3eb1fb0427d4fed0e944b627aef76db651a93aab","https://github.com/solana-foundation/anchor/releases/tag/v1.0.2"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0144","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0144"}],"summary":"`Program<System>` accepts arbitrary executable programs"}