High, CVSS 8.7npmAmendedPublished
@bsv/wallet-toolbox / -client / -mobile don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
CVE-2026-56744 · GHSA-36f9-7rg5-cpf8
- Affected
- npm @bsv/wallet-toolbox >= 1.1.47, < 2.4.0
- Fixed in
- 2.4.0· Vendor fix available
- Issue
- Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient, the storage server returns the outputs to build. buildSignableTransaction takes each non-change output's lockingScript from the storage response and signs it, without comparing it to the lockingScript the caller supplied in args.outputs. WalletPermissionsManager.createAction parses the built transaction and has args.outputs available, but uses the tx only for inputs and getFee(); it does not inspect tx.outputs. A storage provider that returns a different recipient script than requested will therefore have that script signed and broadcast, while the calling app and UI still show the originally requested recipient. Relevant code: - signer/methods/buildSignableTransaction.js — non-change…
Recommended action: Upgrade to 2.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.