CVE-2025-25500 CosmWasm Allows Bypass of Capability Restrictions in Blockchains
Attackers can bypass capability restrictions to deploy unauthorized contracts and execute actions on blockchains using CosmWasm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25500?
CVE-2025-25500 is a high-severity missing authorization vulnerability in n/a, published on 18 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.
Weakness: CWE-284
Which versions are affected by CVE-2025-25500?
2 open source packages ship an affected version, including cosmwasm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cosmwasm crates.io | All versions | 2.2.0 |
cosmwasm crates.io | All versions | 2.2.0 |
Products include Cosmwasm Cosmwasm.
How do I fix CVE-2025-25500?
Upgrade cosmwasm to 2.2.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-25500 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25500 exists.
Sources
Also known as GHSA-cg8r-jwg7-r2x4.