GHSA-qp3j-h5xf-p2p7

Facts

Severity

High · CVSS score 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions (@bsv/lch)

< 0.2.0As entered by the maintainer. Not reviewed.

Fixed in (@bsv/lch)

0.2.0

Affected versions (@bsv/air-gap)

< 0.1.3As entered by the maintainer. Not reviewed.

Fixed in (@bsv/air-gap)

0.1.3

Affected versions (@bsv/amountinator)

< 2.1.6As entered by the maintainer. Not reviewed.

Fixed in (@bsv/amountinator)

2.1.6

Affected versions (@bsv/wallet-helper)

< 0.1.8As entered by the maintainer. Not reviewed.

Fixed in (@bsv/wallet-helper)

0.1.8

Affected versions (create-bsv-app)

< 1.1.2As entered by the maintainer. Not reviewed.

Fixed in (create-bsv-app)

1.1.2

Affected versions (@bsv/did)

< 0.2.6As entered by the maintainer. Not reviewed.

Fixed in (@bsv/did)

0.2.6

Affected versions (@bsv/did-client)

< 1.3.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/did-client)

1.3.2

Affected versions (@bsv/fund-wallet)

< 1.5.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/fund-wallet)

1.5.2

Affected versions (@bsv/simple)

< 0.6.0As entered by the maintainer. Not reviewed.

Fixed in (@bsv/simple)

0.6.0

Affected versions (@bsv/templates)

< 1.10.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/templates)

1.10.2

Affected versions (@bsv/authsocket)

< 2.1.8As entered by the maintainer. Not reviewed.

Fixed in (@bsv/authsocket)

2.1.8

Affected versions (@bsv/authsocket-client)

< 2.1.7As entered by the maintainer. Not reviewed.

Fixed in (@bsv/authsocket-client)

2.1.7

Affected versions (@bsv/message-box-client)

< 2.5.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/message-box-client)

2.5.2

Affected versions (@bsv/paymail)

< 2.4.9As entered by the maintainer. Not reviewed.

Fixed in (@bsv/paymail)

2.4.9

Affected versions (@bsv/402-pay)

< 0.3.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/402-pay)

0.3.2

Affected versions (@bsv/auth)

< 0.1.5As entered by the maintainer. Not reviewed.

Fixed in (@bsv/auth)

0.1.5

Affected versions (@bsv/auth-express-middleware)

< 2.2.5As entered by the maintainer. Not reviewed.

Fixed in (@bsv/auth-express-middleware)

2.2.5

Affected versions (@bsv/payment-express-middleware)

< 2.1.7As entered by the maintainer. Not reviewed.

Fixed in (@bsv/payment-express-middleware)

2.1.7

Affected versions (@bsv/chirp)

< 0.1.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/chirp)

0.1.2

Affected versions (@bsv/teranode-listener)

< 1.1.6As entered by the maintainer. Not reviewed.

Fixed in (@bsv/teranode-listener)

1.1.6

Affected versions (@bsv/gasp)

< 1.3.7As entered by the maintainer. Not reviewed.

Fixed in (@bsv/gasp)

1.3.7

Affected versions (@bsv/overlay)

< 2.6.1As entered by the maintainer. Not reviewed.

Fixed in (@bsv/overlay)

2.6.1

Affected versions (@bsv/overlay-discovery-services)

< 2.2.5As entered by the maintainer. Not reviewed.

Fixed in (@bsv/overlay-discovery-services)

2.2.5

Affected versions (@bsv/overlay-express)

< 2.7.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/overlay-express)

2.7.2

Affected versions (@bsv/overlay-topics)

< 1.8.4As entered by the maintainer. Not reviewed.

Fixed in (@bsv/overlay-topics)

1.8.4

Affected versions (@bsv/sdk)

< 2.8.0As entered by the maintainer. Not reviewed.

Fixed in (@bsv/sdk)

2.8.0

Affected versions (@bsv/verifast)

< 0.3.6As entered by the maintainer. Not reviewed.

Fixed in (@bsv/verifast)

0.3.6

Affected versions (@bsv/btms)

< 1.2.3As entered by the maintainer. Not reviewed.

Fixed in (@bsv/btms)

1.2.3

Affected versions (@bsv/btms-permission-module)

< 1.2.1As entered by the maintainer. Not reviewed.

Fixed in (@bsv/btms-permission-module)

1.2.1

Affected versions (@bsv/ecpm-permission-module)

< 0.1.1As entered by the maintainer. Not reviewed.

Fixed in (@bsv/ecpm-permission-module)

0.1.1

Affected versions (@bsv/wallet-relay)

< 0.5.1As entered by the maintainer. Not reviewed.

Fixed in (@bsv/wallet-relay)

0.5.1

Affected versions (@bsv/wallet-toolbox)

< 2.13.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/wallet-toolbox)

2.13.2

Affected versions (@bsv/wallet-toolbox-client)

< 2.13.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/wallet-toolbox-client)

2.13.2

Affected versions (@bsv/wallet-toolbox-mobile)

< 2.13.2As entered by the maintainer. Not reviewed.

Fixed in (@bsv/wallet-toolbox-mobile)

2.13.2

CVE

None cited by the advisory

GitHub Advisory Database

Not reviewed

OSV.dev

Not present

Other CVEs pointing here

None found in the CVE List

Timeline

1. 2026-09-23 09:19 UTC

   Published by the maintainers

   No CVE cited

2. 2026-10-28 07:18 UTC

   First seen by Limbowatch

   not reviewed · not in OSV

3. Waiting

   Reviewed by GitHub

4. Waiting

   In OSV; scanners can see it

Machine-readable record: feed/GHSA-qp3j-h5xf-p2p7.json