AIKIDO-2026-10790
anchor-lang is vulnerable to Improper Input Validation
82
High Risk
This Affects:
anchor-langTL;DR
On-chain Anchor programs that expose Program<'info, System> assume Anchor rejects accounts that are not the real System Program. A validation mistake collapses that check with the permissive unit-type path so only executability is enforced. An attacker can pass a different executable program id while the program believes it invoked the system program. The corrected validation restores proper system program identity checks for that account type.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
anchor-lang is vulnerable to Improper Input Validation in versions 1.0.0 - 1.0.1.
How to fix this
Upgrade the anchor-lang library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant