Skip to content
OpenAdvisories

Package · npm

openpgp

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2025-47934

    OpenPGP.js's message signature verification can be spoofed

    OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to retur…

    openpgpjs openpgpjs renovate openpgp Wolfi npm
  • High 7.5
    CVE-2019-9154

    Improper Key Verification in openpgp

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.

    openpgp npm
  • High 7.5
    CVE-2019-9153 Public exploit

    Message Signature Bypass in openpgp

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

    openpgp npm
  • High 7.5
    CVE-2015-8013

    OpenPGP 1.2.0 and earlier decrypts arbitrary messages

    s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP me…

    openpgp npm