The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not…
中危 CVSS 6.3
摘要
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their parametric arguments escaped checking. A metaprogram running in the Lean process can register an ill-typed nested inductive whose constructor applies a .proj C 0 projection to a value of the unrelated type W…
中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。
深度研判
该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。
数据来源
- NVD DATABASE
原始链接
- https://github.com/endrazine/lean-cve-poc
- https://github.com/leanprover/lean4
- https://github.com/leanprover/lean4/commit/a39eab69e1eee9ad38f4efe507907b1026a77808
- https://github.com/leanprover/lean4/issues/14576
- https://github.com/leanprover/lean4/pull/14577
- https://github.com/xrchz/CollatzLean
- https://www.openwall.com/lists/oss-security/2026/08/02/1
- https://www.vulncheck.com/advisories/lean-4-kernel-type-checking-bypass-via-mismatched-structure-projections
时间线
- nvd_ingest NVD