CVE-2023-33252

7.5 highEPSS 0.6%

High (7.5) in 0kims snarkjs. EPSS 0.6% chance of exploitation in the next 30 days.

iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.

Severity

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2023-05-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-xp5g-jhg3-3rg2	npm	snarkjs	<=0.6.11	no fix published