Vulnerabilities

TI-2024-36250 CVE-2024-54134 · GHSA-jcxm-7wvp-g6p5

@solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

LOW 37

A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00543 Published 2024-12-04 Fixed in 1.95.8 CWE-200

TI-2024-19999 CVE-2024-30253 · GHSA-8m45-2rjm-j347

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

MEDIUM 40

@solana/web3.js is the Solana JavaScript SDK.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2024-04-17 Fixed in 1.91.3, 1.90.2 +90 CWE-119

TI-2022-16344 CVE-2022-35917 · GHSA-j47c-j42c-mwqq

Weakness in Transfer Validation Logic in @solana/pay

LOW 32

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00866 Published 2022-08-01 Fixed in 0.2.1 CWE-670

TI-2022-13297 CVE-2022-31264 · GHSA-ffx3-8qvm-pq3j

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program…

LOW 36

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01361 Published 2022-05-21 Fixed in 0.2.29 CWE-190

TI-2022-07239 CVE-2022-23066 · GHSA-9qmm-4mfr-r3wj

Solana rBPF - Incorrect Calculation in sdiv instruction

MEDIUM 44

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02516 Published 2022-05-09 Fixed in 0.2.28 CWE-682

TI-2021-21061 CVE-2021-46102 · GHSA-xwqr-xmgg-j69q

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs…