`Program` accepts arbitrary executable programs

{
  "id": "0bfcede4f92fa5d1304d763e4f66ac7ad2bdce7d55f391913d361041913c6719",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0144",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "`Program` accepts arbitrary executable programs",
    "summary": "Affected versions of `anchor-lang` did not properly validate accounts declared as `Program<'info, System>`. The generic `Program` validation path used `Pubkey::default()` as a sentinel to decide whether any executable program should be accepted. Since the system program id is also the default pubkey, `Program<'info, System>` was treated like the untyped `Program<'info>` case and accepted any executable program account. Programs commonly rely on `Program<'info, System>` to ensure that CPI calls and instruction builders target the real Solana system program. With the faulty validation, an attacker could supply another executable program where the system program was expected, causing downstream logic to make false assumptions about payments, account creation, or other system-program CPIs. The issue was fixed in `anchor-lang` 1.0.2 by separating the typed `Program` validation path from the untyped `Program<()>` path, so `Program<'info, System>` now checks the provided account key against the system program id. Users should upgrade to `anchor-lang` 1.0.2 or later.",
    "evidence": "osv:RUSTSEC-2026-0144",
    "products": [
      {
        "name": {
          "value": "anchor-lang",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.0.2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "RUSTSEC-2026-0144",
      "aliases": [
        "CVE-2026-45137",
        "GHSA-c6rc-8jpp-2fgc",
        "RUSTSEC-2026-0144"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.0.0"
                },
                {
                  "fixed": "1.0.2"
                }
              ]
            }
          ],
          "package": {
            "name": "anchor-lang",
            "purl": "pkg:cargo/anchor-lang",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0144.json",
            "categories": [],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [],
              "functions": []
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-12T18:00:13.559737310Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/anchor-lang",
        "https://rustsec.org/advisories/RUSTSEC-2026-0144.html",
        "https://github.com/solana-foundation/anchor/commit/3eb1fb0427d4fed0e944b627aef76db651a93aab",
        "https://github.com/solana-foundation/anchor/releases/tag/v1.0.2"
      ],
      "provider_metadata": {
        "license": "CC-BY-4.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-45137",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 306448,
  "published_at": "2026-05-07T12:00:00+00:00"
}