{"id":"GHSA-8pfh-j44r-f654","aliases":["GO-2025-4041"],"status":"published","title":"Cosmos EVM Vulnerability","description":"## Patches\nPatched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.\n\n## Workarounds\nNo workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.\n\n## Testing\nTests are introduced in every affected version.\n\n## Credits\nSpecial thanks to @yihuang for the help on this issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-10-21T18:04:34Z","modified":"2026-03-03T04:57:01Z","fixes":[{"ecosystem":"Go","package":"github.com/cosmos/evm","fixed_in":["0.3.2","0.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/evm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cosmos/evm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/evm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/evm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.4.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cosmos/evm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"},{"introduced":"0.4.0"},{"fixed":"0.4.2"}]}]}],"references":[{"url":"https://github.com/cosmos/evm/security/advisories/GHSA-8pfh-j44r-f654","tags":["web","advisory"]},{"url":"https://github.com/cosmos/evm/commit/79089feebe79ce1f35250ba457cbd436e6bfff8b","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-8pfh-j44r-f654"},{"url":"https://github.com/cosmos/evm","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-8pfh-j44r-f654","title":"Cosmos EVM Vulnerability","description":"## Patches\nPatched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.\n\n## Workarounds\nNo workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.\n\n## Testing\nTests are introduced in every affected version.\n\n## Credits\nSpecial thanks to @yihuang for the help on this issue.","status":"published","published":"2025-10-21T18:04:34Z","modified":"2025-10-21T18:04:35Z","updated_at":"2026-11-02T14:39:02.474737Z"}],"osv":[{"id":"GHSA-8pfh-j44r-f654","title":"Cosmos EVM Vulnerability","description":"## Patches\nPatched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.\n\n## Workarounds\nNo workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.\n\n## Testing\nTests are introduced in every affected version.\n\n## Credits\nSpecial thanks to @yihuang for the help on this issue.","status":"published","published":"2025-10-21T18:04:34Z","modified":"2025-11-05T19:57:44.4867Z","updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"GO-2025-4041","title":"Cosmos EVM Vulnerability in github.com/cosmos/evm","description":"Cosmos EVM Vulnerability in github.com/cosmos/evm","status":"published","published":"2025-10-30T15:02:33Z","modified":"2026-03-03T04:57:01.809412Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}