bsv-blockchain vulnerabilities

Products

• @bsv/wallet-toolbox 1
• @bsv/wallet-toolbox-client 1
• @bsv/wallet-toolbox-mobile 1
• ts-sdk 1

Latest bsv-blockchain CVEs

Newest publication first

1. CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

   Published 2026-09-24

   High·CVSS 8.7 EPSS 0.38%

   @bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages c...

2. CVE-2025-69287 BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability

   Published 2026-02-18

   Medium·CVSS 5.4 EPSS 0.34%

   The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in sig...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.