CVE-2019-9153: Openpgpjs

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

Affected products

• Openpgpjs Openpgpjs: up to and including 4.1.2

Published 2019-08-22. Last modified 2026-06-17.