{"action":"Upgrade sm-crypto to 0.5.0 or later.","affected":[{"fixed":"0.5.0","introduced":"0"}],"component":"sm-crypto","cve_ids":["CVE-2026-73567"],"ecosystem":"npm","epss":0.00444,"exploited":false,"fixed_versions":["0.5.0"],"ghsa_id":"GHSA-vh45-f885-3848","id":"tcs_01M5KGBXNZGCEAEKHP0XCPXT1X","modified_at":"2026-08-13T17:55:56.606058Z","published_at":"2026-07-24T21:50:45Z","references":["https://osv.dev/vulnerability/GHSA-vh45-f885-3848","https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-vh45-f885-3848","https://github.com/JuneAndGreen/sm-crypto/commit/1f9bd7bd160c24efd9c26c8f7fda997c68c823d0","https://github.com/JuneAndGreen/sm-crypto"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-vh45-f885-3848","url":"https://osv.dev/vulnerability/GHSA-vh45-f885-3848"}],"summary":"sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock"}