Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

mpl-bubblegum

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Creator Verification Error when Bubblegum Activate

    GHSA-8r76-fr72-j32w

    Affected
    • crates.io mpl-bubblegum < 0.6.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →