{"answers":{"affected":"4 open source packages ship an affected version, including bsv-sdk and bsv-wallet. It affects 2 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40070 exists.","fix":"Upgrade bsv-sdk to 0.8.2 or later.","what":"CVE-2026-40070 is a high-severity vulnerability in sgbett bsv-ruby-sdk, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-40070 and fix it if it is affected.\n\nWhat it is: CVE-2026-40070 is a high-severity vulnerability in sgbett bsv-ruby-sdk, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40070 exists.\n\nAffected packages and fixed versions:\n- bsv-sdk (RubyGems): affected from 0.3.1; fixed in 0.8.2\n- bsv-sdk (RubyGems): affected from 0.3.1; fixed in 0.8.2\n- bsv-wallet (RubyGems): affected from 0.1.2; fixed in 0.3.4\n- bsv-wallet (RubyGems): affected from 0.1.2; fixed in 0.3.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-40070/ (Markdown: https://insights.sbomify.com/CVE-2026-40070/index.md)","id":"CVE-2026-40070","markdown":"https://insights.sbomify.com/CVE-2026-40070/index.md","name":"CVE-2026-40070","record":{"aliases":["GHSA-hc36-c89j-5f4j"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"BSV Ruby SDK","requires_auth":"low_privilege","summary":"Attackers can forge identity certificates in the BSV Ruby SDK by bypassing signature verification, leading to fraudulent certificate storage and validation.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"bsv-wallet","vendor":"sgbett"},{"product":"bsv_ruby_sdk","vendor":"sgbett"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"description":"BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)","id":"CVE-2026-40070","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"other","year":"2026"},"n_packages":4,"n_references":5,"next":{"headline":"pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions","id":"CVE-2026-40071"},"packages":[{"ecosystem":"RubyGems","fixed":["0.8.2"],"introduced":["0.3.1"],"last_affected":[],"package":"bsv-sdk","purl":null,"source":"GHSA-hc36-c89j-5f4j"},{"ecosystem":"RubyGems","fixed":["0.8.2"],"introduced":["0.3.1"],"last_affected":[],"package":"bsv-sdk","purl":"pkg:gem/bsv-sdk","source":"GHSA-hc36-c89j-5f4j"},{"ecosystem":"RubyGems","fixed":["0.3.4"],"introduced":["0.1.2"],"last_affected":[],"package":"bsv-wallet","purl":null,"source":"GHSA-hc36-c89j-5f4j"},{"ecosystem":"RubyGems","fixed":["0.3.4"],"introduced":["0.1.2"],"last_affected":[],"package":"bsv-wallet","purl":"pkg:gem/bsv-wallet","source":"GHSA-hc36-c89j-5f4j"}],"prev":{"headline":"bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts","id":"CVE-2026-40069"},"products":["bsv-ruby-sdk","bsv-sdk","bsv-wallet"],"published":"2026-04-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-04-13","vendors":["sgbett"]},"summary":"Attackers can forge identity certificates in the BSV Ruby SDK by bypassing signature verification, leading to fraudulent certificate storage and validation.","url":"https://insights.sbomify.com/CVE-2026-40070/"}