Crypto Vulnerability in sm-crypto JavaScript Implementations by JuneAndGreen
CVE-2026-73567

9.1CRITICAL

Key Information:

Vendor

Juneandgreen

Status
Sm-crypto
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73567?

The sm-crypto library, known for its implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a significant vulnerability in its key generation process. Prior to version 0.5.0, the function sm2.generateKeyPairHex() used a potentially insecure module-wide SecureRandom instance powered by jsbn@1.1.0. Due to reliance on Math.random() and Date.getTime() for random seeding, an attacker could predictably reconstruct the seed values, allowing them to recover private keys and forecast signing ephemeral scalars. This flaw could facilitate the forging of signatures. The issue has been addressed and resolved in the latest version 0.5.0.

Affected Version(s)

sm-crypto < 0.5.0

References

https://github.com/JuneAndGreen/sm-crypto/security/adviso...
x_refsource_CONFIRM
https://github.com/JuneAndGreen/sm-crypto/commit/1f9bd7bd...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.