Malicious Package

Overview wallet-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Monero: `set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM

The setdaemon JSON-RPC in monero-wallet-rpc was found to have a vulnerability that silently ignored the sslallowedfingerprints parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all...

Monero: sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset

The vulnerability in monero-wallet-rpc's signmultisig function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0...

Monero: Wallet RPC Restricted-Mode Policy Bypass

A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform...

Malicious code in wallet-rpc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-4258 Malicious code in wallet-rpc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Monero: [Monero wallet RPC] File precreation to file ownership and credentials leak

The Monero wallet RPC was found to have a vulnerability in the file creation process that could lead to potential credential leakage. The issue was located in the walletrpcserver::init method, where a file was created without using the OEXCL flag, allowing an attacker to pre-create the file and...