GHSA-2W8X-224X-785M sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The...

PT-2026-25873

Name of the Vulnerable Software and Affected Versions sjcl affected versions not specified Description The software is susceptible to an Improper Verification of Cryptographic Signature issue due to missing point-on-curve validation within the sjcl.ecc.basicKey.publicKey function. An attacker can...

sjcl 安全漏洞

sjcl is a deprecated JavaScript encryption library developed by bitwiseshiftleft. Sjcl has a security vulnerability, which stems from the lack of point-to-point verification in sjcl.ecc.basicKey.publicKey. This vulnerability could allow attackers to recover the victim’s ECDH private key by sendin...

@acyclic/keythereum (>=1.1.0 <=1.1.2), @aladas-org/cryptocalc (>=0.2.0 <=0.3.34) +458 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0 <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =11.5.2, =11.5.2, =1.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2026-4258 Source advisory: SNYK:JS-SJCL-15369617...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:sjcl is a Stanford Javascript Crypto Library Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key b...

org.webjars.npm:github-com-aws-amazon-cognito-identity-js (=1.12.0) potentially affected by CVE-2026-4258 via org.webjars.npm:sjcl (=1.0.8)

org.webjars.npm:sjcl MAVEN version =1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sjcl and may be impacted: - org.webjars.npm:github-com-aws-amazon-cognito-identity-js =1.12.0 Source cves: CVE-2026-4258 Source advisory:...

Malicious code in sjcl-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f14284fb077f3168fbd76a2546bb17a5f2c10f18b712b568fa214a4282d50e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6138 Malicious code in sjcl-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f14284fb077f3168fbd76a2546bb17a5f2c10f18b712b568fa214a4282d50e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...