{"action":"Upgrade @keep-network/tbtc-v2 to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"0"}],"component":"@keep-network/tbtc-v2","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-wg2x-rv86-mmpx","id":"tcs_01M5KGEZ48HG22ZSA6G1V47XME","modified_at":"2024-01-19T22:07:47Z","published_at":"2024-01-19T22:07:47Z","references":["https://osv.dev/vulnerability/GHSA-wg2x-rv86-mmpx","https://github.com/keep-network/tbtc-v2/security/advisories/GHSA-wg2x-rv86-mmpx","https://github.com/summa-tx/bitcoin-spv/issues/192","https://github.com/keep-network/tbtc-v2/commit/20a6fb1bfb23d4a3d5b90e00eaa7cc2abc9a2871","https://bitslog.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design","https://github.com/keep-network/tbtc-v2","https://leastauthority.com/static/publications/LeastAuthority_KeepNetwork_tBTC_Bridge_v2_Updated_Final_Audit_Report.pdf","https://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190225/a27d8837/attachment-0001.pdf"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-wg2x-rv86-mmpx","url":"https://osv.dev/vulnerability/GHSA-wg2x-rv86-mmpx"}],"summary":"SPV Merkle proof malleability allows the maintainer to prove invalid transactions"}