Read the docs
TI-2018-15725 Aliases CVE-2018-1000070GHSA-6v4r-9cp8-cpgj

Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit…

Priority MEDIUM 43CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3.

Why it matters now

EPSS 0.02358 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bitmessage:pybitmessage:0.6.2:*:*:*:*:*:*:*0.6.2VulnerableBitmessage
  • cpe:2.3:a:bitmessage:pybitmessage:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·Bitmessage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000070
  2. 2026-10-03 Alias added: GHSA-6v4r-9cp8-cpgj

References

Patch 1

  • TI-2021-08523 PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences