Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

mpl-token-metadata

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Creator Verification Error when Bubblegum Activate

    GHSA-8r76-fr72-j32w

    Affected
    • crates.io mpl-token-metadata >= 1.5.0, < 1.6.3
    Fixed in
    1.6.3· Vendor fix available
    Issue
    This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators. The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360

    Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →