GHSA-36F9-7RG5-CPF8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

@bsv/amountinator (0.2.12), @bsv/cars-cli (>=1.2.0, <=1.2.9) +8 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox-client (1.8.3)

@bsv/wallet-toolbox-client NPM version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @bsv/wallet-toolbox-client and may be impacted: - @bsv/amountinator 0.2.12 - @bsv/cars-cli =1.2.0, =1.2.0, =1.0.0, =0.0.1, =0.2.1, =0.1.0, =0.0.3, =1.1.5,...

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

@1sat/actions (>=0.0.173, <=0.0.190), @1sat/cli (>=0.0.75, <=0.0.90) +21 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox (>=1.8.3, <=2.1.24)

@bsv/wallet-toolbox NPM version =1.8.3, =0.0.173, =0.0.75, =0.0.42, =0.0.74, =0.0.34, =0.0.30, =0.0.71, =0.0.70, =0.0.3, =0.0.75, =0.0.56, =0.0.47, =0.0.25, =0.0.1, =0.0.6 and more Source cves: CVE-2026-56744 Source advisory: OSV:GHSA-36F9-7RG5-CPF8...

CVE-2026-56744

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

EUVD-2026-86301

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744

The @bsv/wallet-toolbox , @bsv/wallet-toolbox-client , and @bsv/wallet-toolbox-mobile packages contain a vulnerability where transactions created via a remote StorageClient do not verify that output locking scripts from the provider match the caller's requested outputs. A compromised provider cou...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744

"@bsv/wallet-toolbox" provides BRC-100 wallet signing and storage components, while "@bsv/wallet-toolbox-client" and "@bsv/wallet-toolbox-mobile" provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

PT-2026-98158

Name of the Vulnerable Software and Affected Versions @bsv/wallet-toolbox versions 1.1.47 through 2.3.3 @bsv/wallet-toolbox-client versions 1.1.47 through 2.3.3 @bsv/wallet-toolbox-mobile versions 1.3.21 through 2.3.3 Description An issue exists where transactions created via a remote StorageClie...

CVE-2026-56744: Improper Validation of Consistency within Input

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...