---
title: "GHSA-8pfh-j44r-f654: Cosmos EVM Vulnerability"
url: https://erroneo.us/security/ghsa/GHSA-8pfh-j44r-f654/
description: "GHSA-8pfh-j44r-f654 (critical, Go): Cosmos EVM Vulnerability. Patches Patched in versions v0.3.1, v0.4.2, and in the v0.5.0 release. More information will…"
type: advisory
section: "Security Digest"
date_published: 2025-10-21
date_modified: 2025-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-8pfh-j44r-f654"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-8pfh-j44r-f654: Cosmos EVM Vulnerability

## Affected packages

- Go `github.com/cosmos/evm` >= 0.3.0, < 0.3.2 → fixed: 0.3.2
- Go `github.com/cosmos/evm` >= 0.4.0, < 0.4.2 → fixed: 0.4.2

## Details

Patches Patched in versions v0.3.1, v0.4.2, and in the v0.5.0 release. More information will be disclosed at a later point to ensure chains have time to safely upgrade. Workarounds No workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended. Testing Tests are introduced in every affected version. Credits Special thanks to @yihuang for the help on this issue.

## Sources

- [GitHub Advisory GHSA-8pfh-j44r-f654](https://github.com/advisories/GHSA-8pfh-j44r-f654)
- [github.com](https://github.com/cosmos/evm/security/advisories/GHSA-8pfh-j44r-f654)
- [github.com](https://github.com/cosmos/evm/commit/79089feebe79ce1f35250ba457cbd436e6bfff8b)

---
Source page: https://erroneo.us/security/ghsa/GHSA-8pfh-j44r-f654/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt