Read the docs
TI-2022-08552 Aliases CVE-2022-24738GHSA-5jgq-x857-p8xw

Account compromise in Evmos

Priority LOW 39CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01068 65th percentileScored 2026-11-07
Fix Fixed evmos (tharsis): 2.0.1github.com/tharsis/evmos (Go): 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tharsisevmosbefore 2.0.12.0.1Patch availableCNA
—github.com/tharsis/evmos (Go)before 2.0.12.0.1Patch availableGHSA-5jgq-x857-p8xw
  • evmos Vendortharsis Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
  • github.com/tharsis/evmos (Go) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-5jgq-x857-p8xw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*before 2.0.1Vulnerableevmos
  • cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:* Versions before 2.0.1 Vulnerable ·evmos

Remediation

  • Fix · CNA evmos (tharsis) Fixed in 2.0.1
  • Fix · GHSA-5jgq-x857-p8xw github.com/tharsis/evmos (Go) Fixed in 2.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24738
  2. 2026-10-03 Alias added: GHSA-5jgq-x857-p8xw

References

Patch 1

Advisory 3

Other 1

  • TI-2022-16363 Ethermint DoS through Unintended Contract Selfdestruct CVSS 3.1HIGH 8.2
  • TI-2024-24680 Evmos's contract balance not updating correctly after interchain transaction CVSS 3.1HIGH 7.5
  • TI-2024-21526 Evmos' transaction execution not accounting for all state transition after interaction with precompiles CVSS 3.1CRITICAL 9.1
  • TI-2024-26619 Evmos vulnerable to exploit of smart contract account and vesting CVSS 3.1HIGH 8.8
  • TI-2024-24685 Evmos is missing precompile checks CVSS 3.1HIGH 8.1
  • TI-2024-24681 Evmos allows unvested token delegations CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences