The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not…
Medium CVSS 6.3
Summary
The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their parametric arguments escaped checking. A metaprogram running in the Lean process can register an ill-typed nested inductive whose constructor applies a .proj C 0 projection to a value of the unrelated type W…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/endrazine/lean-cve-poc
- https://github.com/leanprover/lean4
- https://github.com/leanprover/lean4/commit/a39eab69e1eee9ad38f4efe507907b1026a77808
- https://github.com/leanprover/lean4/issues/14576
- https://github.com/leanprover/lean4/pull/14577
- https://github.com/xrchz/CollatzLean
- https://www.openwall.com/lists/oss-security/2026/08/02/1
- https://www.vulncheck.com/advisories/lean-4-kernel-type-checking-bypass-via-mismatched-structure-projections
Timeline
- nvd_ingest NVD