Hardcoded Initialization Vector in parsel
Summary
GHSA-q643-w9jp-q2qg: Hardcoded Initialization Vector in parsel. Affects parsel versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The parsel package is an npm package used for parsing and manipulating HTML and XML documents. It provides a convenient API for extracting data from web pages. However, all versions of parsel have a default hardcoded initialization vector (IV) which poses a security vulnerability. When the IV is not provided, the package defaults to the hardcoded IV, making the cipher susceptible to chosen plaintext attacks.
Vulnerability Detail
The vulnerability in parsel arises from the use of a hardcoded initialization vector. This means that if an attacker can control the plaintext input to the cipher, they can observe the resulting ciphertext and potentially deduce the key used for encryption. This can lead to unauthorized access to sensitive information or the ability to modify encrypted data. The package is deprecated and will not receive updates, making it crucial to find an alternative package to mitigate this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The parsel package has a hardcoded initialization vector vulnerability that renders the cipher susceptible to chosen plaintext attacks. It is recommended to stop using this package and find an alternative that does not have this security issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for parsel →
FAQ
The vulnerability allows an attacker to potentially deduce the encryption key used by the cipher, leading to unauthorized access to sensitive information or the ability to modify encrypted data.
The parsel package is deprecated and will not receive updates. The recommended fix is to find an alternative package that does not have this security issue.
There are no known workarounds for this vulnerability. It is recommended to find an alternative package.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
You can search for alternative HTML and XML parsing packages on the npm registry or consult with the npm community for recommendations.
References
Related vulnerabilities
Recent vulnerabilities recorded for parsel.
