GHSA-5v7r-jg9r-vq44

Insecure Cryptography Algorithm in simple-crypto-js

5.9 MediumFix available

GHSA-5v7r-jg9r-vq44 is a medium vulnerability (CVSS 5.9) in simple-crypto-js, published September 3, 2020. No source lists public exploit code. Fixed in simple-crypto-js 2.3.0.

What does this mean?

Severity: 5.9 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.3.0simple-crypto-js

Description

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.

Recommendation

Upgrade to version 2.3.0 or later.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`simple-crypto-js` npm	before 2.3.0	2.3.0

What each source reports

GitHub Advisories Score used5.9

Insecure Cryptography Algorithm in simple-crypto-js

Recommendation

Upgrade to version 2.3.0 or later.

Record: GHSA-5v7r-jg9r-vq44
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

OSV5.9

Insecure Cryptography Algorithm in simple-crypto-js

Recommendation

Upgrade to version 2.3.0 or later.

Record: GHSA-5v7r-jg9r-vq44
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

Description

Recommendation

Attack profile

How easy it is to exploit

What an attacker can affect

Affected packages

What each source reports

Recommendation

Recommendation

History

References