AIKIDO-2026-426159
pymonocypher is vulnerable to Modification of Assumed-Immutable Data
71
High Risk
This Affects:
pymonocypherTL;DR
The 32-byte compatibility paths of the signing public-key and signature helpers, together with the Elligator key-pair helper, hand the caller's immutable Python bytes seed object directly to the underlying Monocypher C backend as a writable buffer. Monocypher deliberately wipes that seed after use, which zeroes the caller's original bytes object and every alias of it. Reusing the same seed afterwards silently derives keys or signs under a publicly reproducible all-zero seed. The fix passes a private copy of the seed to Monocypher so the caller's data is preserved.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you reuse a 32-byte seed object with the signing or Elligator key-pair helpers.
Background info
pymonocypher is vulnerable to Modification of Assumed-Immutable Data in versions 4.0.2.3 - 4.0.3.0.
How to fix this
Upgrade the pymonocypher library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.