CVE-2023-33252: 
JavaScript vulnerability analysis and mitigation

iden3 snarkjs through version 0.6.11 contains a vulnerability that allows double spending due to insufficient validation of publicSignals length against the field modulus (NVD). The vulnerability was discovered and disclosed on May 21, 2023.

The vulnerability stems from a missing validation check in the verification process where the publicSignals length is not properly validated against the field modulus. This oversight in the groth16verify.js component creates a security gap that could be exploited ([GitHub Source](https://github.com/iden3/snarkjs/commits/master/src/groth16verify.js)). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The primary impact of this vulnerability is the potential for double spending attacks. Since the vulnerability affects the verification process, it could allow an attacker to bypass important validation checks, potentially leading to unauthorized financial transactions or manipulation of digital assets (NVD).

Users should upgrade to a version newer than 0.6.11 to address this vulnerability. The issue has been fixed in subsequent releases of snarkjs (GitHub Tags).