In short
- CVE-2023-33252 is a HIGH (CVSS 7.5) vulnerability affecting snarkjs (0kims), snarkjs.
- Chance of exploitation in the next 30 days (EPSS): 0.58%, higher than 48.0% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| snarkjs | ≤ 0.6.11
| No fix yet |
| snarkjs npm | ≤ 0.6.11
| No fix yet |
Description
iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.
NVD description
iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free