{"id":"GHSA-2p6r-x3vv-xqm2","aliases":[],"url":"https://o3.security/vulnerability/GHSA-2p6r-x3vv-xqm2","summary":"rpassword affected by partial password reveal when input is interrupted ","details":"rpassword maintainers were made aware of a possible issue with a partial password reveal when input is interrupted.\n\nTo quote @squell:\n\n> @conradkleinespel I've confirmed this problem with SequoiaPGP, which I think uses rpassword, e.g.:\n>\n> Suppose we use pkill -9 sq in a different terminal right after the password has been typed in:\n>\n> $ sq key generate --userid \"barf\" --with-password\n> Enter password to protect the key: Killed\n> $ hello^C\n>\n> Where the password I typed in is \"hello\".\n\nThis has been fixed in version v7.5.0 and above.","published":"2026-05-06T21:49:33Z","modified":"2026-09-10T03:51:04.143649116Z","cvss":{"score":3.8,"severity":"LOW","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"rpassword","fixedVersion":"7.5.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/conradkleinespel/rpassword/security/advisories/GHSA-2p6r-x3vv-xqm2"},{"type":"PACKAGE","url":"https://github.com/conradkleinespel/rpassword"},{"type":"WEB","url":"https://github.com/conradkleinespel/rpassword/releases/tag/v7.5.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:51:04.143649116Z"}}