CVE-2020-11071: False-negative validation results in MINT transactions with invalid baton

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-12 · updated 2026-06-17
Weakness: CWE-697

Description

SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2.

Affected products

simpleledger slpjs: before 0.27.2 — fixed in 0.27.2

How to fix

Upgrade to a fixed version: simpleledger slpjs 0.27.2. Check the vendor advisory for mitigations.

References

https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754
https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6
https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754
https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6

Get alerted when CVE-2020-11071 or the next vulnerability affects your stack