CVE-2026-56744: @bsv/wallet-toolbox Vulnerability in createAction Functionality
Summary
CVE-2026-56744: Reported by @echennells (Eric Chennells). Affects @bsv/wallet-toolbox versions >= 1.1.47, < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @bsv/wallet-toolbox package is a set of tools designed for managing Bitcoin SV wallets. It includes functionalities for creating, signing, and broadcasting transactions. The package is widely used in applications that require secure handling of Bitcoin transactions. However, it has a critical vulnerability that affects how it handles recipient output scripts when interacting with remote storage clients.
Vulnerability Detail
The vulnerability arises from the @bsv/wallet-toolbox package's createAction function, which fails to verify that the recipient output scripts provided by the storage server match those requested by the caller. When a remote StorageClient is used, the server can return altered output scripts, leading to the signing and broadcasting of transactions that do not reflect the user's intended recipient. This issue is particularly dangerous as it allows a malicious storage operator to redirect funds without the user's knowledge.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
npm install @bsv/wallet-toolbox@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using remote storage clients until the package is updated. If remote storage is necessary, implement additional checks to validate the output scripts against the expected values before signing transactions.
Conclusion
The vulnerability identified as CVE-2026-56744 in the @bsv/wallet-toolbox package poses a significant risk by allowing unauthorized changes to transaction recipient scripts. Users are strongly advised to update to the latest version to ensure their applications remain secure.
See every vulnerability recorded for @bsv/wallet-toolbox →
FAQ
CVE-2026-56744 is a vulnerability in the @bsv/wallet-toolbox package that allows a malicious storage operator to alter recipient output scripts, leading to potential fund misdirection.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
If immediate updates are not possible, consider using local storage instead of remote storage to mitigate the risk until you can apply the patch.
The vulnerability can be exploited by the storage operator or anyone who compromises the storage server, allowing them to redirect funds without the user's knowledge.
