Malicious code in cosmos-multisig-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

Code Injection

github.com/cosmos/evm are vulnerable to Code Injection. The vulnerability is due to setting lower EVM call gas limits, which allows the precompile code to partially execute and then fail without reverting the already made state changes...

GO-2025-3684 Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm...

Malicious code in @hotmart-org-ca/cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4248adb5119119c8a93c3615e413df74e456739391ebff8e89f978a212a0659 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

ibc (>=0.11.0, <=0.19.0), ibc-client-tendermint (>=0.48.0, <=0.55.1) +11 more potentially affected by unknown CVE via tendermint-light-client-verifier (>=0.23.5, <=0.38.1)

tendermint-light-client-verifier CARGO version =0.23.5, =0.11.0, =0.48.0, =0.48.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.15.0, =0.1.0, =0.23.5, =0.32.0, =0.23.0, =0.1.0-pre.1, =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-6JRF-4JV4-R9MW...

GO-2025-3520 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) in github.com/cheqd/cheqd-node

cheqd-node Security patch for upstream vulnerabilities in IBC-Go ISA-2025-001 and Cosmos SDK ISA-2025-002 in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

Denial Of Service (DoS)

github.com/cosmos/cosmos-sdk is vulnerable to Denial of Service. The vulnerability is due to improper proposal handling due to malicious proposals triggering errors in the module's end blocker, potentially resulting in a chain halt...

GO-2025-3516 Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/

Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/...

GHSA-H2RP-8VPX-Q9R4 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

Description There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002. ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt. ISA-2025-002 affects the Cosm...

cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

Description There have been two upstream security advisories and associated patches published under ISA-2025-001 and ISA-2025-002. ISA-2025-001 affects the IBC-Go package., where non-deterministic JSON unmarshalling of IBC Acknowledgements can result in a chain halt. ISA-2025-002 affects the Cosm...

GHSA-47WW-FF84-4JRG Cosmos SDK: x/group can halt when erroring in EndBlocker

Name: ISA-2025-002: x/group can halt when erroring in EndBlocker Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.47.16, = 0.50.12 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Cosmos SDK...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions through the EndBlocker process. An attacker can cause the blockchain to halt by submitting malicious proposals that trigger errors in this process. Remediation Upgrade cosmossdk.io/x/group to...

Cosmos SDK: x/group can halt when erroring in EndBlocker

Name: ISA-2025-002: x/group can halt when erroring in EndBlocker Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.47.16, = 0.50.12 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Cosmos SDK...

GO-2025-3476 Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk

Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk...

Malicious code in cosmos-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6053f00c9e4d23811647b64304eb319d346117494a434dad02865fe92a7e68e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1580 Malicious code in cosmos-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6053f00c9e4d23811647b64304eb319d346117494a434dad02865fe92a7e68e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...