Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Naq302 · 2025-09-05T05:38:33Z

Summary

Fixes critical hash state rewind vulnerabilities in crypto dependencies
Updates sha.js from vulnerable ≤2.4.11 to secure 2.4.12 via yarn resolution
Updates cipher-base from vulnerable ≤1.0.4 to secure 1.0.6 via yarn resolution
Eliminates risk of hash manipulation attacks affecting all blockchain operations

Security Impact

Critical vulnerabilities resolved: Both sha.js and cipher-base had hash state rewind bugs that could allow attackers to:

Rewind hash state using crafted input like {length: -x}
Generate hash collisions for different values
Potentially extract private keys in cryptographic operations
Turn tagged hashes into untagged hashes in crypto libraries

This affects all XChainJS blockchain clients (Bitcoin, Ethereum, THORChain, MAYAChain, etc.) since these libraries are used throughout crypto operations for transaction signing, address generation, and key derivation.

Changes

Added "sha.js": "2.4.12" to yarn resolutions in root package.json
Added "cipher-base": "1.0.6" to yarn resolutions in root package.json
Updated yarn.lock with secure versions and new dependency [email protected]

Fixes

Resolves Dependabot security alert Revert bncClient.getBalance #31 (sha.js CVE-2025-9288)
Resolves Dependabot security alert Issue #28 #30 (cipher-base CVE-2025-9287)
Closes https://github.com/xchainjs/xchainjs-lib/security/dependabot/31
Closes https://github.com/xchainjs/xchainjs-lib/security/dependabot/30

Test plan

All 39 packages build successfully
Crypto package tests pass (keystore encryption/decryption, phrase validation)
Bitcoin client tests pass (transaction signing, address generation)
No breaking changes detected
Both vulnerable packages updated to patched versions

Summary by CodeRabbit

Chores
- Updated dependency resolutions to pin "sha.js" and "cipher-base" versions to ensure consistent installs across environments.
- Adjusted dependency list formatting to accommodate the new resolution entries; no code, scripts, or public API changes.
- No functional, UI, performance, or build changes expected for end users.

…-2025-9288) - Add yarn resolution for sha.js@^2.4.12 to address hash state rewind vulnerability - Fixes critical security issue where hash state could be manipulated via crafted input - All crypto operations validated - builds and tests passing - Affects all blockchain operations (Bitcoin, Ethereum, etc.)

coderabbitai · 2025-09-05T05:38:38Z

📝 Walkthrough

Walkthrough

Added two pinned dependency resolutions to package.json and adjusted an existing elliptic entry's formatting; no code, scripts, or public API changes.

Changes

Cohort / File(s)	Summary of changes
Dependency resolution updates `package.json`	Added resolution entries: `"sha.js": "2.4.12"` and `"cipher-base": "1.0.6"`; adjusted formatting of the existing `"elliptic": "^6.6.1"` line (trailing comma) to accommodate new entries.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

update & pin elliptic #1528 — Also modifies package.json resolutions around elliptic pinning.
update to CosmJs 0.34 #1461 — Related changes addressing elliptic / crypto dependency handling and migration.

Suggested reviewers

Thorian1te

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

MCP integration is disabled by default for public repositories
Jira integration is disabled by default for public repositories
Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 932bc4e and 9eef0d4.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

package.json (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: build

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/security-sha-js

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

Visit our Status Page to check the current availability of CodeRabbit.
Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 2

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

MCP integration is disabled by default for public repositories
Jira integration is disabled by default for public repositories
Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 7c5d8a7 and 583cfc4.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

package.json (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: build

🔇 Additional comments (2)

package.json (2)

46-47: Good hotfix: 2.4.12 is the patched version for CVE-2025-9288.

Upgrading sha.js to 2.4.12 remediates the hash state rewind bug (affected: <=2.4.11; fixed: 2.4.12).
References: GitHub Advisory DB, OSV, and vendor feeds confirm the fix window. (github.com, osv.dev, advisories.gitlab.com, ubuntu.com)

46-47: No straggling sha.js versions—verification passed: Yarn resolves every sha.js dependency to 2.4.12, and no workspace directly depends on sha.js.

coderabbitai · 2025-09-05T05:43:13Z

package.json

+    "elliptic": "^6.6.1",
+    "sha.js": "^2.4.12"


⚠️ Potential issue

Root-level resolution doesn’t protect downstream consumers of published packages.

This only enforces the fix for this monorepo’s installs. If any published XChainJS packages ship code that (directly or transitively) pulls sha.js, consumers can still resolve a vulnerable version. Propagate the fix by bumping direct deps or adding a direct "sha.js": "^2.4.12" dependency in each affected workspace package and cut patch releases via Changesets.
Follow-ups:

Add/upgrade direct deps (or bump intermediates like create-hash/crypto-browserify if they carry sha.js).

Run a patch release across affected packages so users get the fix without relying on their own resolutions.
If you want, I can script the package-by-package updates.

package.json

coderabbitai bot reviewed Sep 5, 2025

View reviewed changes

Naq302 changed the title ~~Fix: resolve critical sha.js hash vulnerability (CVE-2025-9288)~~ Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) Sep 5, 2025

Naq302 added 3 commits September 5, 2025 15:21

Also changed to cipher-base@^1.0.5

932bc4e

Pinned versions

cd3fa94

Pinned versions

9eef0d4

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Uh oh!

Naq302 commented Sep 5, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Sep 5, 2025 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Chat

Support

CodeRabbit Commands (Invoked using PR/Issue comments)

Other keywords and placeholders

Status, Documentation and Community

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Sep 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Are you sure you want to change the base?

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Uh oh!

Conversation

Naq302 commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Impact

Changes

Fixes

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Chat

Support

CodeRabbit Commands (Invoked using PR/Issue comments)

Other keywords and placeholders

Status, Documentation and Community

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Naq302 commented Sep 5, 2025 •

edited

Loading

coderabbitai bot commented Sep 5, 2025 •

edited

Loading