HIGH
GHSA-q643-w9jp-q2qg
Hardcoded Initialization Vector in parsel
Details
All versions of `parsel` have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks.
## Recommendation
The package is deprecated and will not be updated. Consider using an alternative package.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/parsel
Introduced in:
0.0.0No fixed version published yet for parsel (npm). Pin to a known-safe version or switch to an alternative.