PT-2026-3893 · Sm-Crypto · Sm-Crypto

Xlabaiteam · Published 2026-01-21 · Updated 2026-02-25 · CVE-2026-23966

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions sm-crypto versions prior to 0.3.14

Description sm-crypto, a JavaScript library providing implementations of Chinese cryptographic algorithms SM2, SM3, and SM4, contains a flaw in the SM2 decryption logic. An attacker can recover the private key by repeatedly interacting with the SM2 decryption interface, requiring approximately several hundred interactions. This issue could compromise confidentiality.

Recommendations Versions prior to 0.3.14 should be updated to version 0.3.14 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-23966

GHSA-PGX9-497M-6C4V

Affected Products

Sm-Crypto

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23966.json · Exploit
• https://github.com/JuneAndGreen/sm-crypto/commit/b1c824e58fdf1eaa73692c124a095819a8c45707 · Patch
• https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-pgx9-497m-6c4v · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgx9-497m-6c4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23966 · Security Note
• https://github.com/JuneAndGreen/sm-crypto · Note
• https://twitter.com/TheHackerWire/status/2014186817940340984 · Twitter Post
• https://twitter.com/_cvereports/status/2014248533902213559 · Twitter Post
• https://t.me/cveNotify/149514 · Telegram Post
• https://twitter.com/pulsepatchio/status/2014348641981300957 · Twitter Post
• https://twitter.com/0dayPublishing/status/2014166434784444684 · Twitter Post
• https://t.me/CVEtracker/42723 · Telegram Post
• https://twitter.com/CVEnew/status/2014182487392768407 · Twitter Post
• https://t.me/cveNotify/153163 · Telegram Post