{"action":"Upgrade elliptic to 6.6.1 or later.","affected":[{"fixed":"6.6.1","introduced":"0"}],"component":"elliptic","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["6.6.1"],"ghsa_id":"GHSA-vjh7-7g9h-fjfh","id":"tcs_01M5KGC64H616KR9656SV5M2WR","modified_at":"2025-02-12T19:47:53Z","published_at":"2025-02-12T19:47:52Z","references":["https://osv.dev/vulnerability/GHSA-vjh7-7g9h-fjfh","https://github.com/indutny/elliptic/security/advisories/GHSA-vjh7-7g9h-fjfh","https://github.com/indutny/elliptic/commit/04cb6f54ce552b3ebde6be06d6050419e1c7333e","https://github.com/indutny/elliptic"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-vjh7-7g9h-fjfh","url":"https://osv.dev/vulnerability/GHSA-vjh7-7g9h-fjfh"}],"summary":"Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)"}