{"action":"Upgrade jsrsasign to 11.1.1 or later.","affected":[{"fixed":"11.1.1","introduced":"0"}],"component":"jsrsasign","cve_ids":["CVE-2026-4601"],"ecosystem":"npm","epss":0.00305,"exploited":false,"fixed_versions":["11.1.1"],"ghsa_id":"GHSA-w8q8-93cx-6h7r","id":"tcs_01M5KGEH9QYW42F75ZS8QSEDSJ","modified_at":"2026-03-29T16:11:30.182175Z","published_at":"2026-03-23T06:30:29Z","references":["https://osv.dev/vulnerability/GHSA-w8q8-93cx-6h7r","https://nvd.nist.gov/vuln/detail/CVE-2026-4601","https://github.com/kjur/jsrsasign/pull/645","https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb","https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586","https://github.com/kjur/jsrsasign","https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-w8q8-93cx-6h7r","url":"https://osv.dev/vulnerability/GHSA-w8q8-93cx-6h7r"}],"summary":"jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction"}