AIKIDO-2025-10197

TL;DR

Affected versions of this package exhibit an observable timing discrepancy due to duplicated vulnerable code from github.com/hashicorp/vault (CVE-2023-25000). HashiCorp Vault’s Shamir secret sharing implementation relies on precomputed table lookups, making it susceptible to cache-timing attacks. An attacker with access to the host and the ability to monitor a large number of unseal operations via a side channel can significantly reduce the search space for brute-force recovery of Shamir shares.