CVE-20XX-XXXX: Bitcoin Core OP_RETURN Arbitrary Data Exposure via Self-Rendering Payloads

Summary

Bitcoin Core v30 and later relay, index, and expose up to 100,000 bytes of arbitrary OP_RETURN data by default. When an attacker embeds a self-rendering Data URI (e.g., data:image/*;base64,…) inside an OP_RETURN output, Bitcoin Core stores the content and makes it accessible through standard JSON-RPC and REST interfaces. Any client retrieving the transaction through these interfaces receives the Data URI in cleartext, which can be immediately rendered by a web browser or other HTTP-capable software without specialized tooling.

This behavior may unintentionally cause node operators to store, retrieve, or serve content that is harmful, illegal, or high-risk, creating operational, security, and legal exposure for downstream systems.

Vulnerability Type

• Improper Handling of Untrusted Data
• Unsafe Default Configuration
• Exposure of Arbitrary Embedded Content
• Inadvertent Content Hosting via Standard Interfaces

Affected Versions

• Bitcoin Core v30.0 and later (default configuration)
• Earlier versions if OP_RETURN relay limits were manually raised above ~83 bytes.

Attack Vector

A malicious actor constructs a transaction containing:

OP_RETURN data:image/png;base64,<arbitrary-content>

or any other self-rendering Data URI (SVG, HTML, PDF, scriptable content, etc.). Once the transaction is mined:

1. Bitcoin Core nodes download the transaction during normal block sync.
2. The node stores the Data URI as cleartext in blk*.dat and LevelDB indexes.
3. Standard APIs (getrawtransaction, decoderawtransaction, getblock) expose the payload exactly as transmitted.
4. Any client, explorer, indexer, or automated system parsing JSON-RPC can inadvertently render the content simply by assigning the string to img.src or embedding it in a web view.

Impact

• Confidentiality: Low to High Stored arbitrary data may include sensitive, harmful, or illegal content.

• Integrity: Low Does not affect blockchain consensus but affects node-operator guarantees.

• Availability: Medium Large payloads may impact indexers, explorers, and downstream software.

• Legal & Operational Risk: High Nodes may involuntarily store or serve content that is:

  • illegal in certain jurisdictions,
  • dangerous to render,
  • or harmful to operators and users. Because Data URIs are immediately self-rendering, the barrier for interpretation is extremely low.

Proof of Concept

1. Broadcast a transaction embedding a Data URI via OP_RETURN.

2. Query any Bitcoin Core v30 node via:

   bitcoin-cli getrawtransaction <txid> true
   

3. Observe the presence of a data:image/... or data:application/... URI in scriptPubKey.asm.

4. Paste the string into a browser’s img.src or an HTML <img> tag.

5. The embedded content renders instantly.

A reproduction demo can be constructed using only HTML and Bitcoin Core RPC.

Severity (CVSS v3.1)

Base Score: 7.3 (High) Vector:

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Rationale: Exploitable by anyone able to broadcast a Bitcoin transaction; affects downstream nodes; triggers unintended content hosting; and can expose operators to significant non-technical risk.

Mitigation

• Reduce OP_RETURN relay and acceptance limits to former defaults (e.g., ~83 bytes).
• Add configuration warnings about untrusted embedded data.
• Implement filtering or sanitization of high-risk MIME types.
• Provide opt-in rather than default behavior for large arbitrary data exposure.
• Offer a “safe mode” for node operators in regulated environments.

Disclosure Timeline

• Discovered: YYYY-MM-DD
• Reported to project: YYYY-MM-DD
• Public disclosure: Pending assignment

Credit

This report was submitted by an independent security researcher concerned with node-operator safety and unintended content exposure.