What’s Vulnerable › Vulnerabilities

CVE-2020-11072: False-negative validation results in MINT transactions with invalid baton

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-12 · updated 2026-06-17
• Weakness: CWE-697

Description

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.

Affected products

• simpleledger slp-validate: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: simpleledger slp-validate 1.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7
• https://github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44
• https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7
• https://github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44

Get alerted when CVE-2020-11072 or the next vulnerability affects your stack