From e1e852ff7f33cdb4d0e14f0ef84ede3d882a1f7b Mon Sep 17 00:00:00 2001 From: Jamie Hill-Daniel Date: Mon, 18 May 2026 19:43:07 +0100 Subject: [PATCH] Add advisory for anchor-lang Program System validation --- crates/anchor-lang/RUSTSEC-0000-0000.md | 36 +++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 crates/anchor-lang/RUSTSEC-0000-0000.md diff --git a/crates/anchor-lang/RUSTSEC-0000-0000.md b/crates/anchor-lang/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..94eb4ce0a --- /dev/null +++ b/crates/anchor-lang/RUSTSEC-0000-0000.md @@ -0,0 +1,36 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "anchor-lang" +date = "2026-05-07" +url = "https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc" +references = ["https://github.com/solana-foundation/anchor/releases/tag/v1.0.2"] +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N" +keywords = ["solana", "anchor", "account-validation", "system-program"] +aliases = ["CVE-2026-45137", "GHSA-c6rc-8jpp-2fgc"] +license = "CC-BY-4.0" + +[versions] +patched = [">= 1.0.2"] +unaffected = ["< 1.0.0"] +``` + +# `Program` accepts arbitrary executable programs + +Affected versions of `anchor-lang` did not properly validate accounts declared +as `Program<'info, System>`. The generic `Program` validation path used +`Pubkey::default()` as a sentinel to decide whether any executable program +should be accepted. Since the system program id is also the default pubkey, +`Program<'info, System>` was treated like the untyped `Program<'info>` case and +accepted any executable program account. + +Programs commonly rely on `Program<'info, System>` to ensure that CPI calls and +instruction builders target the real Solana system program. With the faulty +validation, an attacker could supply another executable program where the system +program was expected, causing downstream logic to make false assumptions about +payments, account creation, or other system-program CPIs. + +The issue was fixed in `anchor-lang` 1.0.2 by separating the typed +`Program` validation path from the untyped `Program<()>` path, so +`Program<'info, System>` now checks the provided account key against the system +program id. Users should upgrade to `anchor-lang` 1.0.2 or later.