False-positive validity for NFT1 genesis transactions in SLPJS
Priority LOW 35CWE-697Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.
Why it matters now
EPSS 0.01036 64th percentileScored 2026-11-07
Fix Fixed slpjs (simpleledger): 0.27.4slpjs (npm): 0.27.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| simpleledger | slpjs | before 0.27.4 | 0.27.4 | Patch available | CNA |
| — | slpjs (npm) | before 0.27.4 | 0.27.4 | Patch available | GHSA-cc2p-4jhr-xhhx |
- slpjs Vendorsimpleledger Affected before 0.27.4 Fixed in 0.27.4 Patch available CNA
- slpjs (npm) Vendor— Affected before 0.27.4 Fixed in 0.27.4 Patch available GHSA-cc2p-4jhr-xhhx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:* | before 0.27.4 | Vulnerable | simpleledger |
- cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:* Versions before 0.27.4 Vulnerable ·simpleledger
Remediation
- Fix · CNA slpjs (simpleledger) Fixed in 0.27.4
- Fix · GHSA-cc2p-4jhr-xhhx slpjs (npm) Fixed in 0.27.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15130
- 2026-10-03 Alias added: GHSA-cc2p-4jhr-xhhx
References
More simpleledger Slpjs vulnerabilities
- TI-2020-08945 False-negative validation results in MINT transactions with invalid baton CVSS 3.1HIGH 8.6
- TI-2019-12543 Validator parsing discrepancy due to string encoding in NPM slpjs CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-15130 · CVE Program
- CVE-2020-15130 · NVD
- FIRST EPSS
- GHSA-cc2p-4jhr-xhhx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences