VulnerableCode Package Details - pkg:npm/openpgp@0.4.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-1k95-3kbq-9ker Aliases: CVE-2019-9154 GHSA-hfmf-q43v-2ffj	Improper Verification of Cryptographic Signature Improper Verification of a Cryptographic Signature in OpenPGP.js allows an attacker to pass off unsigned data as signed.	4.2.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-1nnb-p2s9-8qef Aliases: CVE-2019-9155 GHSA-77jf-fjjf-xcww	Cryptographic Issues A cryptographic issue in OpenPGP.js allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.	4.2.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 4.3.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-7ufh-3v6b-v3h9 Aliases: CVE-2019-9153 GHSA-qwqc-28w3-fww6	Improper Verification of Cryptographic Signature Improper Verification of a Cryptographic Signature in OpenPGP.js allows an attacker to forge signed messages by replacing its signatures with a `standalone` or `timestamp` signature.	4.2.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-vtt2-cbxn-s7by Aliases: CVE-2015-8013 GHSA-qmvq-f3fj-m3wg	OpenPGP 1.2.0 and earlier decrypts arbitrary messages s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.	1.3.0 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-y9pn-esju-ffec Aliases: CVE-2023-41037 GHSA-ch3c-v47x-4pgp	Improper Verification of Cryptographic Signature OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.	4.10.11 Affected by 0 other vulnerabilities. 5.0.0-0 Affected by 0 other vulnerabilities. 5.10.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-1k95-3kbq-9ker
Aliases:
CVE-2019-9154
GHSA-hfmf-q43v-2ffj

Improper Verification of Cryptographic Signature Improper Verification of a Cryptographic Signature in OpenPGP.js allows an attacker to pass off unsigned data as signed.

4.2.0
Affected by 2 other vulnerabilities.

VCID-1nnb-p2s9-8qef
Aliases:
CVE-2019-9155
GHSA-77jf-fjjf-xcww

Cryptographic Issues A cryptographic issue in OpenPGP.js allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

4.2.1
Affected by 1 other vulnerability.

4.3.0
Affected by 1 other vulnerability.

VCID-7ufh-3v6b-v3h9
Aliases:
CVE-2019-9153
GHSA-qwqc-28w3-fww6

Improper Verification of Cryptographic Signature Improper Verification of a Cryptographic Signature in OpenPGP.js allows an attacker to forge signed messages by replacing its signatures with a `standalone` or `timestamp` signature.

4.2.0
Affected by 2 other vulnerabilities.

VCID-vtt2-cbxn-s7by
Aliases:
CVE-2015-8013
GHSA-qmvq-f3fj-m3wg

OpenPGP 1.2.0 and earlier decrypts arbitrary messages s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

1.3.0
Affected by 4 other vulnerabilities.

VCID-y9pn-esju-ffec
Aliases:
CVE-2023-41037
GHSA-ch3c-v47x-4pgp

Improper Verification of Cryptographic Signature OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.

4.10.11
Affected by 0 other vulnerabilities.

5.0.0-0
Affected by 0 other vulnerabilities.

5.10.1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T04:04:08.316368+00:00	GitLab Importer	Affected by	VCID-y9pn-esju-ffec	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openpgp/CVE-2023-41037.yml	38.6.0
2026-06-06T02:10:13.882806+00:00	GitLab Importer	Affected by	VCID-vtt2-cbxn-s7by	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openpgp/CVE-2015-8013.yml	38.6.0
2026-06-04T20:24:14.602523+00:00	GitLab Importer	Affected by	VCID-1k95-3kbq-9ker	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openpgp/CVE-2019-9154.yml	38.6.0
2026-06-04T20:24:14.335373+00:00	GitLab Importer	Affected by	VCID-7ufh-3v6b-v3h9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openpgp/CVE-2019-9153.yml	38.6.0
2026-06-04T20:24:14.004505+00:00	GitLab Importer	Affected by	VCID-1nnb-p2s9-8qef	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openpgp/CVE-2019-9155.yml	38.6.0