Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.
Predictable SM2 key generation in sm-crypto via weak Node.js RNG (CVE-2026-73567)
The sm-crypto npm package's default `sm2.generateKeyPairHex()` path in Node.js seeds its module-wide SecureRandom instance (from jsbn) using `Math.random()` and `Date.getTime()` instead of a cryptographically secure s...
Fixed in 0.5.3
Server-side template injection in @prompty/core Nunjucks renderer (CVE-2026-73299)
The TypeScript Nunjucks renderer in @prompty/core evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype prope...
Fixed in @prompty/core >= 0.1.5; @prompty/core >= 2.0.0-beta.5
Missing authorization on ApprovalInbox GET routes in Network-AI (CVE-2026-64622)
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, allowing unauthenticated actors to retrieve full Ap...
Fixed in 5.13.4