{"action":"Upgrade openpgp to 5.11.3 or later.","affected":[{"fixed":"5.11.3","introduced":"5.0.1"},{"fixed":"6.1.1","introduced":"6.0.0-alpha.0"}],"component":"openpgp","cve_ids":["CVE-2025-47934"],"ecosystem":"npm","epss":0.00645,"exploited":false,"fixed_versions":["5.11.3","6.1.1"],"ghsa_id":"GHSA-8qff-qr5q-5pr8","id":"tcs_01M5KFDR5QKC1TB29NJCK5BRX8","modified_at":"2026-09-10T03:50:57.513503191Z","published_at":"2025-05-19T21:54:43Z","references":["https://osv.dev/vulnerability/GHSA-8qff-qr5q-5pr8","https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8","https://nvd.nist.gov/vuln/detail/CVE-2025-47934","https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229","https://github.com/openpgpjs/openpgpjs/commit/843a69d0adbdec0f87af09f9000a9223e6614e5c","https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356","https://github.com/openpgpjs/openpgpjs","https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3","https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-8qff-qr5q-5pr8","url":"https://osv.dev/vulnerability/GHSA-8qff-qr5q-5pr8"},{"source":"nvd","source_id":"CVE-2025-47934","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47934"}],"summary":"OpenPGP.js's message signature verification can be spoofed"}