Double spend in snarkjs

Description

iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.6.11

References

• GHSA-xp5g-jhg3-3rg2
• CVE-2023-33252
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• SSRF & Credentials Leak - CVE-2023-49799
• Path Traversal in droppy - CVE-2020-7757
• HTML Injection in preact - Vulnerability
• Command Injection in dot - Vulnerability

Tags:

npm

snarkjs