Vulnerability RUSTSEC-2026-0529

KVStoreInterpreter::verify_signature_legacy(&PushDrop, &PublicKey), public and deprecated since 0.2.0 (the crate's first release), read neither argument and answered true. A KVStore token signed by nobody, a signed token checked against a key other than its controller's, and a PushDrop with no fields each passed. Its documentation said it delegated to the KVStoreFields-based verifier; it did not.

An application that checks, with this function, a KVStore token it did not write (an overlay lookup's answer, or a transaction output a peer hands it) and acts on true accepts a value no controller signed, attributed to whatever controller the token names. No caller in the crate itself uses the function. This was run on 0.2.0, 0.5.0, 0.8.0, 0.8.7, 0.8.8, 0.9.0-beta.1 and 0.9.0-beta.7 as crates.io serves them, and the source of all 63 published versions carries the same constant body (the yanked 0.3.21 included).

0.8.9 answers true only for a token whose controller field is the given key and whose last field is that key's signature over the others (the 0.9 line's next prerelease carries the same fix). There is no workaround: upgrade to 0.8.9, or, on the 0.9 line, to its next prerelease.