CVE-2025-25500

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

7.5 HighFix available

An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.80%Up 0.7 points since Mar 19, 2025

What each source reports

CVE List Score used 7.5

Record: CVE-2025-25500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2025-7225 7.5

Record: EUVD-2025-7225
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cg8r-jwg7-r2x4 5.3

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

Record: GHSA-cg8r-jwg7-r2x4
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284, CWE-306
Updated: 2026-11-02

NVD 7.5

Record: CVE-2025-25500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV 7.5

Record: CVE-2025-25500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-cg8r-jwg7-r2x4 5.3

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

Record: GHSA-cg8r-jwg7-r2x4
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284, CWE-306
Updated: 2026-11-02

Affected products

cosmwasm

Affected packages

Affected packages
Package	Affected	Fixed
`cosmwasm` crates.io	before 2.2.0	2.2.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-25500 is a high vulnerability (CVSS 7.5) in Cosmwasm, published March 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in cosmwasm 2.2.0.