Description

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

INFO

Published Date :

2026-01-22T02:06:54.003Z

Last Modified :

2026-01-22T15:49:07.259Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-23966 vulnerability.

Vendors Products
Juneandgreen
  • Sm-crypto
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-23966.

URL Resource
https://github.com/JuneAndGreen/sm-crypto/commit/b1c824e58fdf1eaa73692c124a095819a8c45707 cve-icon cve-icon
https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact