github.com/CosmWasm/wasmvm (Go)
Advisories
12
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.5.8 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/CosmWasm/wasmvm@v1.5.8 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production |
Medium | < 1.5.8 | 1.5.8 |
| GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production |
Medium | >= 0.1.0, < 1.5.8 | 1.5.8 |
| GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production |
Medium | < 0.0.0-20250204093451-1f4db20199b8 | 0.0.0-20250204093451-1f4db20199b8 |
| GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production |
Medium | >= 1.5.8-0, < 1.5.8-0.20250204093451-1f4db20199b8 | 1.5.8-0.20250204093451-1f4db20199b8 |
| GHSA-2q97-m5rc-p3gp CosmWasm VM Incorrect metering |
Medium | < 1.5.5 | 1.5.5 |
| GHSA-vmqh-5232-v43r Panic in wasmvm can slow down block production |
Medium | < 1.5.5 | 1.5.5 |
| GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm |
Medium | >= 1.5.0, < 1.5.1 | 1.5.1 |
| GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm |
Medium | < 1.2.5 | 1.2.5 |
| GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm |
Medium | >= 1.3.0, < 1.3.1 | 1.3.1 |
| GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm |
Medium | >= 1.4.0, < 1.4.2 | 1.4.2 |
| GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm |
Medium | < 1.2.5>= 1.3.0, < 1.3.1>= 1.4.0, < 1.4.2>= 1.5.0, < 1.5.1 | 1.2.51.3.11.4.21.5.1 |
| GHSA-rg2q-2jh9-447q Gas mispricing in cosmwasm-vm |
Medium | < 1.5.4 | 1.5.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor