GitHub Advisoryadvisory · npm
GHSA-27v7-qhfv-rqq8 Insecure Credential Storage in web3
LOW
Official page ↗
- Ecosystem
- npm
- Packages
- web3
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Reviewed
- 2019-05-30
Affected packages
• npm web3: <= 1.5.2 (no fix yet)
Description
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.