Rocq Prover 9.2.0 Universe Checking Bypass Proof of Concept

Rocq Prover versions up to and including 9.2.0 contain a kernel soundness vulnerability caused by improper restoration of universe checking state when a module closes. The Local Unset Universe Checking directive can leave the kernel's universe graph with validation disabled even after the global...

Malicious Package

Overview math-universe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16367 Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-72714

A flaw was found in Rocq Prover. When a module that locally disabled the universe checking flag is closed, the prover fails to restore the universe graph's copy of this flag. This desynchronization allows the kernel to accept terms that are inconsistent with the universe, even though the system...

CVE-2020-37268

A flaw was found in Coq and Rocq provers. The Print Assumptions feature, which is used to audit the soundness of proofs, fails to report when a definition was created without proper "universe checking" a mechanism to ensure logical consistency. This occurs when the definition is incorporated...

CVE-2026-72714

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2020-37268

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714

Rocq Prover (through 9.2.0) contains a state desynchronization in its universe checking mechanism. When a module that locally disabled the universe checking flag is closed, the global flag is restored but the universe graph retains its own copy left disabled . The kernel then accepts universe-inc...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

EUVD-2026-65143

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

EUVD-2020-31263

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2020-37268 Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2020-37268 Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2020-37268

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2020-37268

Coq and Rocq provers are affected by a soundness flaw in the Print Assumptions audit command. When a definition is created with universe checking disabled and later inlined via Parameter Inline in a module type, the inlining drops the record of the unsafe operation. The resulting constant carries...

PT-2026-81016

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...