Malicious code in aws-encryption-sdk-javascript (npm)

Source: ossf-package-analysis ded7612b942b1e3da52d4dfc7abcb64d6ad4bd30d80fac04815238838f9f4763 The OpenSSF Package Analysis project identified 'aws-encryption-sdk-javascript' @ 23.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

acmetk (0.0.2), aioasuswrt (1.3.3) +137 more potentially affected by CVE-2026-69248 via cryptography (3.3.2)

cryptography PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - acmetk 0.0.2 - aioasuswrt 1.3.3 - ais-dom =2021.3.0b4, =1.6.0, =10.0.0, =1.10.0, =1.8.0, =2.20.0, =2.20.0, =1.0.1, =0.3.27, =0.5.6, =0.8...

20220429-pdfminer-jameslp310 (0.0.2), adapta (>=2.0.0, <=3.3.6) +347 more potentially affected by CVE-2026-69249 via cryptography (36.0.2)

cryptography PYPI version 36.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 20220429-pdfminer-jameslp310 0.0.2 - adapta =2.0.0, =0.0.53, =2022.7.7b1, =0.3.11, =1.4.0.dev7, =3.7.1b1, =1.6.1, =14.0.0, =0.0.3,...

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

SummaryAWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

aws-encryption-sdk-cli (>=2.1.0, <=3.1.0), cloudformation-cli-python-lib (>=2.1.9, <=2.1.16) +5 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=2.0.0, <=3.3.0)

aws-encryption-sdk PYPI version =2.0.0, =2.1.0, =2.1.9, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.2.2 Source cves: CVE-2026-6550 Source advisory: OSV:PYSEC-2026-2387...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: OSV:PYSEC-2026-2387...

PYSEC-2026-2387 AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

PT-2026-59067

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

20220429-pdfminer-jameslp310 (0.0.2), adapta (>=2.0.0, <=3.3.6) +347 more potentially affected by CVE-2024-0727 via cryptography (36.0.2)

cryptography PYPI version 36.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 20220429-pdfminer-jameslp310 0.0.2 - adapta =2.0.0, =0.0.53, =2022.7.7b1, =0.3.11, =1.4.0.dev7, =3.7.1b1, =1.6.1, =14.0.0, =0.0.3,...

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

aws-encryption-sdk-cli (>=2.1.0, <=3.1.0), cloudformation-cli-python-lib (>=2.1.9, <=2.1.16) +2 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=2.0.0, <=3.1.1)

aws-encryption-sdk PYPI version =2.0.0, =2.1.0, =2.1.9, =1.0.0, =1.0.1, =1.0.5 Source cves: CVE-2026-6550 Source advisory: GHSA-V638-38FC-RHFV...

aws-encryption-sdk-cli (>=2.1.0, <=3.1.0), cloudformation-cli-python-lib (>=2.1.9, <=2.1.16) +5 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=2.0.0, <=3.3.0)

aws-encryption-sdk PYPI version =2.0.0, =2.1.0, =2.1.9, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.2.2 Source cves: CVE-2026-6550 Source advisory: OSV:GHSA-V638-38FC-RHFV...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: GHSA-V638-38FC-RHFV...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: OSV:GHSA-V638-38FC-RHFV...

cloudformation-cli-python-lib (>=2.1.12, <=2.1.16), core-aws (>=1.0.0, <=1.0.4) +4 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=3.1.0, <=3.3.0)

aws-encryption-sdk PYPI version =3.1.0, =2.1.12, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.2.2 Source cves: CVE-2026-6550 Source advisory: SNYK:PYTHON-AWSENCRYPTIONSDK-16115497...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: SNYK:PYTHON-AWSENCRYPTIONSDK-16115497...

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Overview aws-encryption-sdk is an AWS Encryption SDK implementation for Python Affected versions of this package are vulnerable to Selection of Less-Secure Algorithm During Negotiation 'Algorithm Downgrade' via the shared key cache. An attacker can bypass key commitment policy enforcement by...

CVE-2026-6550

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be...

CVE-2026-6550

The vulnerability CVE-2026-6550 affects the AWS Encryption SDK for Python in its caching layer. A cryptographic downgrade in the key cache could allow an authenticated local actor to bypass key commitment policy enforcement, enabling ciphertext to be decrypted into multiple possible plaintexts. A...

aws-encryption-sdk-cli (>=1.8.0, <=3.1.0), cloud-backup (1.0.0) +7 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=1.3.7, <=3.3.0)

aws-encryption-sdk PYPI version =1.3.7, =1.8.0, =2.1.9, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.0.2, =1.0.17 Source cves: CVE-2026-6550 Source advisory: MEND:CVE-2026-6550...