GHSA-6qqf-vvcr-7qrv
Cryptographically Weak PRNG in generate-password
GHSA-6qqf-vvcr-7qrv is a vulnerability with no CVSS score yet in generate-password, published May 23, 2019. No source lists public exploit code. Fixed in generate-password 1.4.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.1generate-password
Description
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.
Recommendation
Update to version 1.4.1 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
generate-passwordnpm | before 1.4.1 | 1.4.1 |
What each source reports
GitHub AdvisoriesNo score
Cryptographically Weak PRNG in generate-password
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.
Recommendation
Update to version 1.4.1 or later.
- Record
GHSA-6qqf-vvcr-7qrv- Weakness
- CWE-338
- Updated
- 2026-11-02
OSVNo score
Cryptographically Weak PRNG in generate-password
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.
Recommendation
Update to version 1.4.1 or later.
- Record
GHSA-6qqf-vvcr-7qrv- Weakness
- CWE-338
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.