Description
Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory.
Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD
Summary: When createAction runs against a remote StorageClient, the storage server returns the outputs to build.
Recommendation
Update the @bsv/wallet-toolbox-client package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.1.47, < 2.4.0
- Patched version(s): 2.4.0
References
Could your website be exposed too?
SmartScanner can check your website for `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requ and gives you actionable findings to investigate.
Start a free scanRelated Issues
- `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requ - @bsv/wallet-toolbox - CVE-2026-56744
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-r2 - CVE-2026-34750
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-gcs - CVE-2026-34750
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure - CVE-2026-34750
You might also like:
See something that needs correcting? Let us knowUpdated September 24, 2026