GitHub Advisoryadvisory · Go

GHSA-8pfh-j44r-f654 Cosmos EVM Vulnerability

CRITICAL Published 2025-10-21 Modified 2025-10-21 Official page ↗
Ecosystem
Go
Packages
github.com/cosmos/evm
Severity
Critical
Reviewed
2025-10-21

Affected packages

• Go github.com/cosmos/evm: >= 0.3.0, < 0.3.2 → fixed in 0.3.2 • Go github.com/cosmos/evm: >= 0.4.0, < 0.4.2 → fixed in 0.4.2

Description

Patches Patched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade. Workarounds No workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended. Testing Tests are introduced in every affected version. Credits Special thanks to @yihuang for the help on this issue.

References