An attacker can submit crafted requests to the /send_transaction endpoint of Chia Blockchain, leading to unauthorized execution of blockchain transactions. The flaw is a cross‑site request forgery that allows a malicious actor to make the node perform actions on behalf of a legitimate user or owner of that node. While the vulnerability is hard to exploit and requires sophisticated manipulation, it could compromise the integrity of the blockchain if successful, allowing fraudulent transfers.

The vulnerability affects the Chia Blockchain client, specifically version 2.1.0. No other versions are listed as affected, and the vendor has not reported additional impacted releases.

The CVSS score of 2.3 indicates a low overall severity. The EPSS score of less than 1% shows that the likelihood of exploitation is very small at present. The vulnerability has not been identified as a known exploited vulnerability by CISA. The attack requires remote access to the node’s RPC endpoint, and the exploitation is considered difficult, but since the exploit is public, the risk remains moderate as it could be leveraged by determined attackers with sufficient knowledge.