Skip to content
OpenAdvisories

Package · npm

xml-crypto

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High —
    GHSA-c27r-x354-4m68

    xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

    ### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case tha…

    xml-crypto npm