GHSA-47ww-ff84-4jrg: Cosmos SDK: x/group can halt when erroring in EndBlocker

March 12, 2025 (updated October 31, 2025)

Name: ISA-2025-002: x/group can halt when erroring in EndBlocker Component: CosmosSDK Criticality: High (Considerable Impact; Likely Likelihood per ACMv1.2) Affected versions: <= v0.47.16, <= 0.50.12 Affected users: Validators, Full nodes, Users on chains that utilize the groups module Cosmos SDK chains in unpatched releases that use the x/group module are affected.

References

github.com/advisories/GHSA-47ww-ff84-4jrg
github.com/cosmos/cosmos-sdk
github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a
github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg

Code Behaviors & Features

Detect and mitigate GHSA-47ww-ff84-4jrg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →