CVE-2026-40072

CVE-2026-40072 – SSRF via CCIP Read in web3.py Affected: web3.py (Python library) versions 6.0.0b3 through before 7.15.0 and 8.0.0b2. The CCIP Read / OffchainLookup (EIP-3668) implementation fetches URLs supplied by contracts without destination validation and with default-on exposure (global_cci...

CVE-2026-40072 web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these...

EUVD-2026-21000

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these...

web3.py 代码问题漏洞

web3.py is an open-source Python library developed by ethereum for interacting with the Ethereum blockchain. There were code-related vulnerabilities in versions of web3.py from 6.0.0b3 to 7.15.0, as well as in version 8.0.0b2. These vulnerabilities stemmed from a lack of target validation when...

Server-side Request Forgery (SSRF)

Overview web3 is a web3: A Python library for interacting with Ethereum Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CCIP Read process. An attacker can cause the application to make arbitrary HTTP requests to internal or external destinations by...

PT-2026-31674

Name of the Vulnerable Software and Affected Versions web3.py versions 6.0.0b3 through 7.15.0 web3.py versions 6.0.0b3 through 8.0.0b2 Description web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in the offchain lookup...

Malicious Package

Overview web3-docs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in argon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 608cea5b2c28269fa6aa53d4dcd211b83843a935732729e7ec08a2a2130d9209 The package argon-web3-chain was found to contain malicious code. Source: ghsa-malware 6680014069f64072ffb4e22ed7e3779a0b88e7c503644cb0a491d67605078c...

MAL-2026-1005 Malicious code in argon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 608cea5b2c28269fa6aa53d4dcd211b83843a935732729e7ec08a2a2130d9209 The package argon-web3-chain was found to contain malicious code. Source: ghsa-malware 6680014069f64072ffb4e22ed7e3779a0b88e7c503644cb0a491d67605078c...

Malicious Package

Overview argon-web3-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Malicious Package

Overview sinon-web3-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-896 Malicious code in sinon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0984c139608f25fa3bdb0532d380ee76d21328bb17bb2d72f996112391a4e239 The package sinon-web3-chain was found to contain malicious code. Source: ghsa-malware 19e2ec9a6d3e1d35b0423ee04424704fd978ba989624faa1485f07c6de16b3...

Malicious code in web3-sinon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6990443632c3224a5e897d1747fcd76f782eda8d020447076d59cf305b03c82 The package web3-sinon was found to contain malicious code. Source: ghsa-malware 7d195e4b1eda9212f69e313de4107deae82670a9615ec25b86c8aaaf3df0e1f9 Any...

Malicious Package

Overview web3-sinon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in web3-chain-sinon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d656a8031870a05e2b7fa8dec1f3f9b9b48c3d8de3d93df42c787c139b0693a5 The package web3-chain-sinon was found to contain malicious code. Source: ghsa-malware f522ddb6d36708e509e4e4074bed2658a3a1e4101d4a45bb588e08c611cc33...

MAL-2026-806 Malicious code in web3-chain-sinon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d656a8031870a05e2b7fa8dec1f3f9b9b48c3d8de3d93df42c787c139b0693a5 The package web3-chain-sinon was found to contain malicious code. Source: ghsa-malware f522ddb6d36708e509e4e4074bed2658a3a1e4101d4a45bb588e08c611cc33...

MAL-2026-807 Malicious code in web3-sinon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6990443632c3224a5e897d1747fcd76f782eda8d020447076d59cf305b03c82 The package web3-sinon was found to contain malicious code. Source: ghsa-malware 7d195e4b1eda9212f69e313de4107deae82670a9615ec25b86c8aaaf3df0e1f9 Any...

Malicious code in web3-meme-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62aebca1848d232cb70d5bacf954626ca7d0fd1d5680bb8ab45777aa9347f5ed Disguised as metadata checker, packages are designed to exfiltrate hardcoded or given data to an obfuscated remote target --- Category: MALICIOUS - The campaig...

MAL-2026-763 Malicious code in web3-meme-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62aebca1848d232cb70d5bacf954626ca7d0fd1d5680bb8ab45777aa9347f5ed Disguised as metadata checker, packages are designed to exfiltrate hardcoded or given data to an obfuscated remote target --- Category: MALICIOUS - The campaig...