GHSA-vjvw-wcmw-pr26
Insufficient Entropy in parsel
All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.
Recommendation
The package is deprecated and will not be updated. Consider using an alternative package.
What each source reports
GitHub AdvisoriesNo score
Insufficient Entropy in parsel
All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.
Recommendation
The package is deprecated and will not be updated. Consider using an alternative package.
- Record
GHSA-vjvw-wcmw-pr26- Weakness
- CWE-331
- Updated
- 2026-11-02
OSVNo score
Insufficient Entropy in parsel
All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.
Recommendation
The package is deprecated and will not be updated. Consider using an alternative package.
- Record
GHSA-vjvw-wcmw-pr26- Weakness
- CWE-331
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
parselnpm | 0.0.0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vjvw-wcmw-pr26 is a vulnerability with no CVSS score yet in parsel, published September 4, 2020. No source lists public exploit code. No source names a fixed version.