metamask @metamask/sdk-react vulnerabilities

Latest metamask @metamask/sdk-react CVEs

Newest publication first

1. GHSA-qj3p-xc97-xw74 MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency

   Published 2025-09-15

   Unknown

   Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: Installed MetaMask SDK into a project with a lockfile for t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.