Executive brief
parsel is a deprecated npm package used for encryption operations. The package uses a hardcoded initialization vector (IV) for cipher operations, which weakens encryption security. An attacker with knowledge of the IV can perform chosen plaintext attacks to decrypt or forge encrypted data, potentially exposing sensitive information protected by the package.
Technical details
parsel contains a cryptographic weakness: all versions default to a hardcoded initialization vector when none is provided by the caller. This violates cryptographic best practices, as IVs must be unique and unpredictable for each encryption operation to prevent attacks. The vulnerability allows an attacker to perform chosen plaintext attacks against data encrypted with this library, potentially recovering plaintext or forging valid ciphertexts. No patch is available; the package is deprecated and will not be updated. Users should migrate to alternative encryption libraries.
Affected products
- npm parsel all versions
Timeline
- 2020-09-04: disclosed