[Security advisory] New attack from malicious remote nodes

There is a vulnerability in Monero wallets that can be exploited by a malicious remote node. The vulnerability has a CVSS score of 6.5 (medium severity). The impact of the exploit is more than just privacy loss, but the attacker cannot steal Monero from your wallet.

I recommend to stop using 3rd party remote nodes immediately. Run your own node instead. If you can't avoid using a 3rd party node, make sure you trust the node operator.

This vulnerability was reported in January on HackerOne. Unfortunately, there is no easy way to fix it. Due to the limited impact of the exploit, the Monero team has decided not to provide a patch. Full details of the vulnerability will be disclosed soon.