CVE-2023-41646

5.3 mediumEPSS 0.5%

Medium (5.3) in perrymitchell buttercup. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in buttercup 7.4.0.

Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/

Severity

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-916
Published: 2023-09-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7cwq-p8cr-h9qg	npm	buttercup	>=2.20.3 <7.4.0	7.4.0