Skip to content
OpenAdvisories

Package · npm

parsel

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical —
    GHSA-vjvw-wcmw-pr26

    Insufficient Entropy in parsel

    All versions of `parsel` use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching. ## …

    parsel npm
  • Critical —
    GHSA-wqgx-4q47-j2w5

    Insecure Cryptography Algorithm in parsel

    All versions of `parsel` use an insecure cryptography algorithm. The package uses `aes-256-cbc` without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks. ## Recommendation The package is deprecated and will not be updated. Con…

    parsel npm
  • High —
    GHSA-q643-w9jp-q2qg

    Hardcoded Initialization Vector in parsel

    All versions of `parsel` have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks. ## Recommendation The package is deprecated…

    parsel npm