# Pending Program Review

**URL:** https://ghostforum.org/c/bug-bounty/pending-program-review/14.md

[Latest](https://ghostforum.org/latest.md) · [Categories](https://ghostforum.org/categories.md) · [Tags](https://ghostforum.org/tags.md)

---

## [About the Pending Program Review category](https://ghostforum.org/t/about-the-pending-program-review-category/183)

<div class="topic-metadata">

**Author:** [@Colossus](https://ghostforum.org/u/Colossus)\
**Replies:** 0\
**Last updated:** [October 11, 2026, 11:20am UTC](https://ghostforum.org/t/about-the-pending-program-review-category/183 "2026-10-11T11:20:44Z")

</div>

Reports that have been validated by triage and are waiting for the internal team’s assessment.

---

## [\[High\] Content script bridge trusts a spoofable origin field in sign requests](https://ghostforum.org/t/high-content-script-bridge-trusts-a-spoofable-origin-field-in-sign-requests/112)

<div class="topic-metadata">

**Author:** [@BYFOR](https://ghostforum.org/u/BYFOR)\
**Replies:** 4\
**Last updated:** [October 12, 2026, 2:41am UTC](https://ghostforum.org/t/high-content-script-bridge-trusts-a-spoofable-origin-field-in-sign-requests/112 "2026-10-12T02:41:43Z")

</div>

Severity: High Component: ghost-extension-wallet @ 66bd2077c7e82629eba7574466dd1cd94fac2bb9 (content/index.ts lines 17 to 25, background/createBackgroundRpc.ts lines 84 to 125 and 346 to 361, SignRequest.tsx lines 59 to …

---

## [\[ghost-dao-interface\] Bond "Recipient Address" setting can never work: purchaseBond signs with the wrong account](https://ghostforum.org/t/ghost-dao-interface-bond-recipient-address-setting-can-never-work-purchasebond-signs-with-the-wrong-account/174)

<div class="topic-metadata">

**Author:** [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)\
**Replies:** 1\
**Last updated:** [October 11, 2026, 1:20pm UTC](https://ghostforum.org/t/ghost-dao-interface-bond-recipient-address-setting-can-never-work-purchasebond-signs-with-the-wrong-account/174 "2026-10-11T13:20:44Z")

</div>

Component: ghost-dao-interface @ a911859, src/hooks/bonds/index.js:275-294 (purchaseBond), src/containers/Bond/components/BondConfirmModal.jsx:111-120. Description: The bond purchase UI exposes a recipient address field…