False-positive validity for NFT1 genesis transactions in SLP Validate
Priority LOW 35CWE-697Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.
Why it matters now
EPSS 0.01036 64th percentileScored 2026-11-07
Fix Fixed slp-validate.js (simpleledger): 1.2.2slp-validate (npm): 1.2.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| simpleledger | slp-validate.js | before 1.2.2 | 1.2.2 | Patch available | CNA |
| — | slp-validate (npm) | before 1.2.2 | 1.2.2 | Patch available | GHSA-6jmr-jfh7-xg3h |
- slp-validate.js Vendorsimpleledger Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- slp-validate (npm) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-6jmr-jfh7-xg3h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simpleledger:slp-validate:*:*:*:*:*:*:*:* | before 1.2.2 | Vulnerable | simpleledger |
- cpe:2.3:a:simpleledger:slp-validate:*:*:*:*:*:*:*:* Versions before 1.2.2 Vulnerable ·simpleledger
Remediation
- Fix · CNA slp-validate.js (simpleledger) Fixed in 1.2.2
- Fix · GHSA-6jmr-jfh7-xg3h slp-validate (npm) Fixed in 1.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15131
- 2026-10-03 Alias added: GHSA-6jmr-jfh7-xg3h
References
More simpleledger Slp-validate vulnerabilities
- TI-2020-08946 False-negative validation results in MINT transactions with invalid baton CVSS 3.1HIGH 8.6
- TI-2019-12542 Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0 CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-15131 · CVE Program
- CVE-2020-15131 · NVD
- FIRST EPSS
- GHSA-6jmr-jfh7-xg3h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences