Skip to content

Conversation

@mcalancea
Copy link
Contributor

@mcalancea mcalancea commented Jul 31, 2025

circomkit installs circom_tester@0.0.19. In turn, this installs an old version of snarkjs which suffers from GHSA-xp5g-jhg3-3rg2. Consequently, circomkit introduces a critical vulnerability in npm audit reports.

I think that the vulnerability doesn't affect circomkit directly (it would be nice to confirm that), but updating circom_tester seems to not break anything and cleans up the package audit.

@erhant
Copy link
Owner

erhant commented Jul 31, 2025

Nice catch, thank you! Indeed the vuln seems to be about field calculations which is beyond Circomkit, to confirm.

@erhant erhant added the bug Something isn't working label Jul 31, 2025
@erhant erhant merged commit 71dee7e into erhant:main Jul 31, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants