Description
`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing
Published: 2026-09-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Fund Misdirection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises because @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile do not verify that the output locking scripts returned by a remote StorageClient match those requested by the caller. A malicious or compromised storage provider can replace the intended recipient script or add an additional output, causing the wallet to sign and broadcast a transaction that diverts funds while the user interface continues to show the original recipient. This flaw permits unauthorized transfer of wallet funds and is classified as CWE-1288.

Affected Systems

Affected products are bsv-blockchain’s @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile. Vulnerable versions include wallet-toolbox 1.1.47 through 2.3.3 and wallet-toolbox-client 1.1.47 through 2.3.3, as well as mobile 1.3.21 through 2.3.3. All three packages are fixed in version 2.4.0.

Risk and Exploitability

The CVSS score of 8.7 signals high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires a remote StorageClient; an attacker who controls or compromises the storage provider can forge transaction outputs, redirect payments, and bypass the wallet’s UI. Consequently, any system that relies on remote storage for transaction creation is vulnerable unless the software is patched or the remote storage path is removed.

Generated by OpenCVE AI on September 25, 2026 at 05:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile to version 2.4.0 or later.
  • If upgrading is not possible, disable the use of remote StorageClient providers and switch to local storage.
  • When remote storage must be used, independently verify each output’s locking script and value against the originally requested outputs before signing.

Generated by OpenCVE AI on September 25, 2026 at 05:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-36f9-7rg5-cpf8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
History

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Bsv-blockchain
Bsv-blockchain wallet-toolbox
Bsv-blockchain wallet-toolbox-client
Bsv-blockchain wallet-toolbox-mobile
Vendors & Products Bsv-blockchain
Bsv-blockchain wallet-toolbox
Bsv-blockchain wallet-toolbox-client
Bsv-blockchain wallet-toolbox-mobile

Thu, 24 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description `@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing
Title `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)
Weaknesses CWE-1288
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Bsv-blockchain Wallet-toolbox Wallet-toolbox-client Wallet-toolbox-mobile
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T17:17:16.996Z

Reserved: 2026-06-22T19:17:28.959Z

Link: CVE-2026-56744

cve-icon Vulnrichment

Updated: 2026-09-28T17:16:47.114Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T17:17:05.047

Modified: 2026-09-30T19:57:08.043

Link: CVE-2026-56744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T14:16:55Z

Weaknesses
  • CWE-1288

    Improper Validation of Consistency within Input