{"id":"GHSA-5v7r-jg9r-vq44","aliases":[],"status":"published","title":"Insecure Cryptography Algorithm in simple-crypto-js","description":"Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.\n\n\n## Recommendation\n\nUpgrade to version 2.3.0 or later.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2020-09-03T21:19:46Z","modified":"2023-04-17T15:44:10Z","fixes":[{"ecosystem":"npm","package":"simple-crypto-js","fixed_in":["2.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"simple-crypto-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"npm","package":"simple-crypto-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]}],"references":[{"url":"https://github.com/danang-id/simple-crypto-js/issues/12","tags":["web"]},{"url":"https://robertheaton.com/2013/07/29/padding-oracle-attack/"},{"url":"https://snyk.io/vuln/SNYK-JS-SIMPLECRYPTOJS-544027","tags":["web"]},{"url":"https://github.com/danang-id/simple-crypto-js/pull/17","tags":["web"]},{"url":"https://github.com/danang-id/simple-crypto-js/commit/416584369de1dad9b21ac3fe85df0b71cf5718b2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5v7r-jg9r-vq44"},{"url":"https://github.com/danang-id/simple-crypto-js","tags":["package"]},{"url":"https://robertheaton.com/2013/07/29/padding-oracle-attack","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-5v7r-jg9r-vq44","title":"Insecure Cryptography Algorithm in simple-crypto-js","description":"Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.\n\n\n## Recommendation\n\nUpgrade to version 2.3.0 or later.","status":"published","published":"2020-09-03T21:19:46Z","modified":"2023-04-17T15:44:10Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"osv":[{"id":"GHSA-5v7r-jg9r-vq44","title":"Insecure Cryptography Algorithm in simple-crypto-js","description":"Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.\n\n\n## Recommendation\n\nUpgrade to version 2.3.0 or later.","status":"published","published":"2020-09-03T21:19:46Z","modified":"2021-09-29T20:08:01Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}