GHSA-cc2p-4jhr-xhhx

Source

https://github.com/advisories/GHSA-cc2p-4jhr-xhhx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-cc2p-4jhr-xhhx/GHSA-cc2p-4jhr-xhhx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cc2p-4jhr-xhhx

Aliases

CVE-2020-15130

Published

2020-07-30T14:58:42Z

Modified

2026-09-10T03:49:25Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

False-positive validity for NFT1 genesis transactions in SLPJS

Details

Impact

In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

Patches

npm package "slpjs" has been patched and is published and tagged as version 0.27.4.

Workarounds

Upgrade to slpjs 0.27.4.

References

Package location: https://www.npmjs.com/package/slpjs
SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
Git commit hash fixing this issue: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

For more information

If you have any questions or comments about this advisory please open an issue in the slp-validate repository.

Database specific

{
    "cwe_ids":  [
        "CWE-697"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-07-30T14:44:06Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / slpjs

Package

Name: slpjs; View open source insights on deps.dev
Purl: pkg:npm/slpjs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.27.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-cc2p-4jhr-xhhx/GHSA-cc2p-4jhr-xhhx.json"