`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bsv-blockchain | @bsv/wallet-toolbox | 1.1.47 to before 2.4.0 | 2.4.0 | Patch available | CNA |
| bsv-blockchain | @bsv/wallet-toolbox-client | 1.1.47 to before 2.4.0 | 2.4.0 | Patch available | CNA |
| bsv-blockchain | @bsv/wallet-toolbox-mobile | 1.3.21 to before 2.4.0 | 2.4.0 | Patch available | CNA |
| — | @bsv/wallet-toolbox (npm) | 1.1.47 to before 2.4.0 | 2.4.0 | Patch available | GHSA-36f9-7rg5-cpf8 |
| — | @bsv/wallet-toolbox-client (npm) | 1.1.47 to before 2.4.0 | 2.4.0 | Patch available | GHSA-36f9-7rg5-cpf8 |
| — | @bsv/wallet-toolbox-mobile (npm) | 1.3.21 to before 2.4.0 | 2.4.0 | Patch available | GHSA-36f9-7rg5-cpf8 |
- @bsv/wallet-toolbox Vendorbsv-blockchain Affected 1.1.47 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
- @bsv/wallet-toolbox-client Vendorbsv-blockchain Affected 1.1.47 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
- @bsv/wallet-toolbox-mobile Vendorbsv-blockchain Affected 1.3.21 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
- @bsv/wallet-toolbox (npm) Vendor— Affected 1.1.47 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-36f9-7rg5-cpf8
- @bsv/wallet-toolbox-client (npm) Vendor— Affected 1.1.47 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-36f9-7rg5-cpf8
- @bsv/wallet-toolbox-mobile (npm) Vendor— Affected 1.3.21 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-36f9-7rg5-cpf8
Remediation
- Fix · CNA @bsv/wallet-toolbox (bsv-blockchain) Fixed in 2.4.0
- Fix · CNA @bsv/wallet-toolbox-client (bsv-blockchain) Fixed in 2.4.0
- Fix · CNA @bsv/wallet-toolbox-mobile (bsv-blockchain) Fixed in 2.4.0
- Fix · GHSA-36f9-7rg5-cpf8 @bsv/wallet-toolbox (npm) Fixed in 2.4.0 Advisory →
- Fix · GHSA-36f9-7rg5-cpf8 @bsv/wallet-toolbox-client (npm) Fixed in 2.4.0 Advisory →
- Fix · GHSA-36f9-7rg5-cpf8 @bsv/wallet-toolbox-mobile (npm) Fixed in 2.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56744
- 2026-10-03 Alias added: GHSA-36f9-7rg5-cpf8
References
Other 6
- https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8
- https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28
- https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949
- https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b
- https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07
- https://github.com/bsv-blockchain/ts-stack
More bsv-blockchain vulnerabilities
- TI-2025-42732 BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-56744 · CVE Program
- CVE-2026-56744 · NVD
- FIRST EPSS
- GHSA-36f9-7rg5-cpf8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences