{"id":"GHSA-27v7-qhfv-rqq8","aliases":[],"status":"published","title":"Insecure Credential Storage in web3","description":"All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-05-30T17:26:30Z","modified":"2023-01-09T05:01:18Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"web3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"web3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.5.2"}]}]}],"references":[{"url":"https://github.com/ethereum/web3.js/issues/2739","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-WEB3-174533","tags":["web"]},{"url":"https://www.npmjs.com/advisories/877","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27v7-qhfv-rqq8"},{"url":"https://github.com/ethereum/web3.js","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-27v7-qhfv-rqq8","title":"Insecure Credential Storage in web3","description":"All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","status":"published","published":"2019-05-30T17:26:30Z","modified":"2023-01-09T05:01:18Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-27v7-qhfv-rqq8","title":"Insecure Credential Storage in web3","description":"All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.","status":"published","published":"2019-05-30T17:26:30Z","modified":"2021-08-31T20:56:47Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}