AIKIDO-2026-10257
@malloydata/malloy is vulnerable to Use of Weak Hash
68
Medium Risk
This Affects:
@malloydata/malloyTL;DR
Affected versions of this package are vulnerable to sensitive information exposure due to the use of a weak hashing algorithm when generating connection digests. The makeDigest() function relies on MD5 to hash values that may contain database connection strings, including embedded credentials such as passwords. Because MD5 is not considered cryptographically secure, attackers may be able to recover or infer sensitive information from generated digests. The issue is fixed by replacing MD5 with the stronger SHA-256 hashing algorithm, ensuring credentials included in connection digests are protected using a secure cryptographic hash.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@malloydata/malloy is vulnerable to Use of Weak Hash in versions 0.0.1 - 0.0.337.
How to fix this
Upgrade the @malloydata/malloy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant