False-negative validation results in MINT transactions with invalid baton

Description

Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user’s minting baton.

Recommendation

Update the slpjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.27.2
• Patched version(s): 0.27.2

References

• GHSA-jc83-cpf9-q7c6
• CVE-2020-11071
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Volto affected by possible DoS by invoking specific URL by anonymous user - CVE-2025-58047
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 3 - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 2 - CVE-2024-52810
• angular-base64-upload vulnerable to unauthenticated remote code execution - CVE-2024-42640

Tags:

npm

slpjs