AIKIDO-2026-531727
risc0-zkvm is vulnerable to Reliance on Untrusted Inputs in a Security Decision
29
Low Risk
This Affects:
risc0-zkvmTL;DR
The zkVM exposes host-backed syscalls sys_getenv, sys_argc, and sys_argv so guest programs can read environment variables and arguments supplied by the proving host. These syscalls are enabled by default and their values are treated as trusted, even though a zkVM guest generally should not trust the host in zero-knowledge threat models. A malicious proving host can supply crafted environment or argument values to influence guest execution and induce insecure behavior in guests that consume them. The fix disables these syscalls by default and requires guests to opt in through a feature flag.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your guest program consumes host-provided values through sys_getenv, sys_argc, or sys_argv while being proven on an untrusted host.
Background info
risc0-zkvm is vulnerable to Reliance on Untrusted Inputs in a Security Decision in versions 0.0.1 - 1.1.2.
How to fix this
Upgrade the risc0-zkvm library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant