CVE-2025-25500

Name of the Vulnerable Software and Affected Versions CosmWasm versions prior to 2.2.0

Description The issue allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This enables attackers to deploy a contract without capability enforcement and execute unauthorized actions on the blockchain.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting contract deployment to trusted sources until the update is applied.