Insecure Cryptography Algorithm in simple-crypto-js

Description

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.

Recommendation

Update the simple-crypto-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.0
• Patched version(s): 2.3.0

References

• GHSA-5v7r-jg9r-vq44
• robertheaton.com
• snyk.io
• CWE-327
• OWASP 2021-A2

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
• QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049

Tags:

npm

simple-crypto-js