CVE-2022-39354

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.

• CWE-670
• CWE-670

• https://github.com/rust-blockchain/evm/pull/133Patch, Third Party Advisory
• https://github.com/rust-blockchain/evm/security/advisories/GHSA-hhc4-47rh-cr34Third Party Advisory
• https://github.com/rust-blockchain/evm/pull/133Patch, Third Party Advisory
• https://github.com/rust-blockchain/evm/security/advisories/GHSA-hhc4-47rh-cr34Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39349The Tasks.org Android app is an open-source app for to-do li…5.5
• CVE-2022-3935The Welcart e-Commerce WordPress plugin before 2.8.4 does no…5.4
• CVE-2022-39350@dependencytrack/frontend is a Single Page Application (SPA)…5.4
• CVE-2022-39351Dependency-Track is a Component Analysis platform that allow…4.4
• CVE-2022-39352OpenFGA is a high-performance authorization/permission engin…9.8
• CVE-2022-39353xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…9.8
• CVE-2022-39355Discourse Patreon enables syncronization between Discourse G…9.8
• CVE-2022-39356Discourse is a platform for community discussion. Users who …8.8
• CVE-2022-39357Winter is a free, open-source content management system base…9.8
• CVE-2022-39358Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39359Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-3936The Team Members WordPress plugin before 5.2.1 does not sani…4.8