GitHub Advisoryadvisory · crates.io

GHSA-cg8r-jwg7-r2x4 CosmWasm Allows Bypass of Capability Restrictions in Blockchains

MEDIUM Published 2025-03-18 Modified 2025-03-21 Official page ↗
Aliases
CVE-2025-25500
Ecosystem
crates.io
Packages
cosmwasm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284, CWE-306
Reviewed
2025-03-18

Affected packages

• crates.io cosmwasm: < 2.2.0 → fixed in 2.2.0

Description

An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.

Related

Alias · CVE (1)

  • CVE-2025-25500 An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References