CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
A malicious storage provider can redirect cryptocurrency payments by injecting unauthorized transaction outputs that bypass client-side verification in BSV wallet libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56744?
CVE-2026-56744 is a high-severity vulnerability in bsv-blockchain @bsv/wallet-toolbox, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing
Weakness: CWE-1288
Which versions are affected by CVE-2026-56744?
6 open source packages ship an affected version, including @bsv/wallet-toolbox, @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile.
| Package | Affected | Fixed in |
|---|---|---|
@bsv/wallet-toolbox npm | From 1.1.47 | 2.4.0 |
@bsv/wallet-toolbox npm | From 1.1.47 | 2.4.0 |
@bsv/wallet-toolbox-client npm | From 1.1.47 | 2.4.0 |
@bsv/wallet-toolbox-client npm | From 1.1.47 | 2.4.0 |
@bsv/wallet-toolbox-mobile npm | From 1.3.21 | 2.4.0 |
@bsv/wallet-toolbox-mobile npm | From 1.3.21 | 2.4.0 |
How do I fix CVE-2026-56744?
Upgrade @bsv/wallet-toolbox to 2.4.0 or later.
Is CVE-2026-56744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56744 exists.
Sources
Also known as GHSA-36f9-7rg5-cpf8.