Advisories for Cargo/Anchor-Lang package

2026

Anchor: Program<'info, System> is not properly validated

An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions.

Anchor: `InterfaceAccount` allows account substitution between unexpected types

Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type. The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details.