Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / GHSA-xfrc-7mj2-5xh9

crítica

GHSA-xfrc-7mj2-5xh9

Undefined Behavior in zencashjs

Publicada Modificada
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

Ninguna fuente da una puntuación CVSS.

La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.

Descripción

Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost. ## Recommendation Upgrade to version 1.2.0 or later.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
npm::GitHub Security Advisory npmzencashjs1.2.0

Referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.