EUVD-2026-58182
GHSA-vh45-f885-3848
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because the attacker must observe same-process Math.random() outputs and estimate generation time; PR:N/UI:N as no auth or victim action is needed; C:H/I:H for key recovery and signature forgery, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by jsbn@1.1.0, which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.
Articles & Coverage 2
AnalysisAI
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to run sm-crypto (< 0.5.0) in Node.js and use the default no-argument sm2.generateKeyPairHex() key-generation and signing path, which routes through jsbn's SecureRandom fallback; no caller-selected parameter or non-default configuration is needed to trigger the weak RNG. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) treats this as a network, low-complexity, unauthenticated confidentiality-and-integrity break, which likely overstates the practical attack conditions: exploitation is not a single crafted request but a cryptanalytic recovery requiring the attacker to observe several Math.random() outputs from the same V8 process and estimate the key-generation timestamp. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A service uses sm-crypto in Node.js to mint SM2 key pairs and separately exposes values derived from Math.random() to clients (for example request IDs, tokens, or timing jitter). An attacker collects a handful of those outputs to reconstruct the V8 xorshift128+ state, combines it with an estimate of the key-generation timestamp to rebuild the ARC4 seed, then recovers the victim's SM2 private key and predicts signing ephemeral scalars - enabling decryption and signature forgery. … |
| Remediation | Upgrade to the fixed release: Vendor-released patch: sm-crypto 0.5.0, which changes SM2 random-number generation to use Node's crypto module (per the CHANGELOG and commit 1f9bd7bd160c24efd9c26c8f7fda997c68c823d0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production instances of sm-crypto versions prior to 0.5.0 and assess their security context. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today