GHSA-x3r2-fj3r-g5mv — sealed-env-core
CRITICALGHSA-x3r2-fj3r-g5mv is a critical-severity (CVSS 9.1) Information Exposure vulnerability in io.github.davidalmeidac:sealed-env-core. A fix is available for io.github.davidalmeidac:sealed-env-core — see the affected versions and patch details below.
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-x3r2-fj3r-g5mv.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-x3r2-fj3r-g5mv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
sealed-envnpmDescription
In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext.
An attacker with (a) the master key (e.g. from a separate compromise such as a leaked CI secret) and (b) any single leaked unseal token can use the extracted TOTP secret to mint new valid unseal tokens for any future deploy indefinitely, breaking the second-factor property the library claimed.
Patched in 0.1.0-alpha.4 by replacing the embedded secret with a salt-bound HMAC derivative (enterprise_epoch = HMAC(totpSecret, salt || "epoch-v1")). The TOTP secret never leaves the operator's machine in the new design. The wire format change is incompatible — files sealed by affected versions must be re-sealed and the TOTP secret rotated. Full migration playbook in CHANGELOG.md.
Reported by an external reviewer who decoded the payload of a real minted token and confirmed bit-for-bit equality with the operator's .env.local TOTP secret.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.github.davidalmeidac:sealed-env-core | all versions | 0.1.0-alpha.4io.github.davidalmeidac:sealed-env-core:0.1.0-alpha.4 |
| 📦npm | sealed-env | all versions | 0.1.0-alpha.4npm install sealed-env@0.1.0-alpha.4 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.github.davidalmeidac:sealed-env-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update io.github.davidalmeidac:sealed-env-core to 0.1.0-alpha.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x3r2-fj3r-g5mv is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is GHSA-x3r2-fj3r-g5mv in your dependencies?
Find it across Maven, npm, including transitive dependencies.