OpenPGP 1.2.0 and earlier decrypts arbitrary messages

Description

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

Recommendation

Update the openpgp package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.0
• Patched version(s): 1.3.0

References

• GHSA-qmvq-f3fj-m3wg
• www.openwall.com
• CVE-2015-8013
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
• Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - CVE-2026-39363
• @mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url - CVE-2026-35394
• SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

openpgp