Vulnerability-Lookup

CVE-2026-71851 (GCVE-0-2026-71851)

Vulnerability from cvelistv5 – Published: 2026-08-07 18:48 – Updated: 2026-08-08 03:05

Title

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Summary

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-08 03:05 UTC

CWE

CWE-331 - Insufficient Entropy
CWE-334 - Small Space of Random Values
CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/brix/crypto-js/security/adviso…	x_refsource_CONFIRM
https://github.com/brix/crypto-js/commit/b405ff59…	x_refsource_MISC
https://www.coinspect.com/blog/ill-bloom-investigation	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
brix	crypto-js	Affected: < 4.0.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71851",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-08T03:05:26.687602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-08T03:05:53.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "patch"
            ],
            "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "crypto-js",
          "vendor": "brix",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-331",
              "description": "CWE-331: Insufficient Entropy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-334",
              "description": "CWE-334: Small Space of Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T18:48:08.348Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
        },
        {
          "name": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
        },
        {
          "name": "https://www.coinspect.com/blog/ill-bloom-investigation",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
        }
      ],
      "source": {
        "advisory": "GHSA-rg76-677x-56q9",
        "discovery": "UNKNOWN"
      },
      "title": "crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71851",
    "datePublished": "2026-08-07T18:48:08.348Z",
    "dateReserved": "2026-08-07T18:26:53.523Z",
    "dateUpdated": "2026-08-08T03:05:53.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71851",
      "date": "2026-11-01",
      "epss": "0.0055",
      "percentile": "0.45999"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "crypto-js",
                "vendor": "brix",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.0.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0."
          },
          {
            "lang": "es",
            "value": "crypto-js es una biblioteca JavaScript de est\u00e1ndares criptogr\u00e1ficos. Las versiones de crypto-js anteriores a la 4.0.0 generan aleatoriedad en CryptoJS.lib.WordArray.random() utilizando una variaci\u00f3n personalizada del generador de n\u00fameros pseudoaleatorios Multiply-With-Carry, sembrado a partir de Math.random(), en lugar de una fuente criptogr\u00e1ficamente segura. Este generador fue introducido en la versi\u00f3n 3.1.2-4 y permaneci\u00f3 presente en casi todas las versiones 3.x. Las solicitudes nominales de 128 o 256 bits de entrop\u00eda a trav\u00e9s de esta funci\u00f3n producen espacios de b\u00fasqueda efectivos de aproximadamente 2 elevado a la 39 y 2 elevado a la 47 posibilidades, lo suficientemente peque\u00f1os como para ser enumerados en hardware comercial. Las aplicaciones de monedero descendentes que utilizaron CryptoJS.lib.WordArray.random() como fuente de entrop\u00eda para frases de recuperaci\u00f3n BIP39 se ven afectadas, y un atacante que enumere el espacio de salida reducido puede recuperar las claves privadas resultantes y controlar los fondos asociados. Este problema est\u00e1 solucionado en la versi\u00f3n 4.0.0."
          }
        ],
        "id": "CVE-2026-71851",
        "lastModified": "2026-10-24T15:10:00.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-71851",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-08T03:05:26.687602Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-07T19:18:54.390",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-331"
              },
              {
                "lang": "en",
                "value": "CWE-334"
              },
              {
                "lang": "en",
                "value": "CWE-338"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-18T22:00:35+00:00",
      "cve": "CVE-2026-71851",
      "id": "CVE-2026-71851",
      "initial_release_date": "2026-08-07T18:48:08.348000+00:00",
      "product_status:known_not_affected": "94",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "crypto-js: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71851.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71851",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-08T03:05:26.687602Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-08T03:05:47.344Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "patch"
                ],
                "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "crypto-js",
              "vendor": "brix",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.0.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-331",
                  "description": "CWE-331: Insufficient Entropy",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-334",
                  "description": "CWE-334: Small Space of Random Values",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-338",
                  "description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-07T18:48:08.348Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
            },
            {
              "name": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
            },
            {
              "name": "https://www.coinspect.com/blog/ill-bloom-investigation",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
            }
          ],
          "source": {
            "advisory": "GHSA-rg76-677x-56q9",
            "discovery": "UNKNOWN"
          },
          "title": "crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-71851",
        "datePublished": "2026-08-07T18:48:08.348Z",
        "dateReserved": "2026-08-07T18:26:53.523Z",
        "dateUpdated": "2026-08-08T03:05:53.995Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-71851

Vulnerability from fkie_nvd - Published: 2026-08-07 19:18 - Updated: 2026-10-24 15:10

Severity

9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5
	security-advisories@github.com	https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9
	security-advisories@github.com	https://www.coinspect.com/blog/ill-bloom-investigation
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "crypto-js",
          "vendor": "brix",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0."
    },
    {
      "lang": "es",
      "value": "crypto-js es una biblioteca JavaScript de est\u00e1ndares criptogr\u00e1ficos. Las versiones de crypto-js anteriores a la 4.0.0 generan aleatoriedad en CryptoJS.lib.WordArray.random() utilizando una variaci\u00f3n personalizada del generador de n\u00fameros pseudoaleatorios Multiply-With-Carry, sembrado a partir de Math.random(), en lugar de una fuente criptogr\u00e1ficamente segura. Este generador fue introducido en la versi\u00f3n 3.1.2-4 y permaneci\u00f3 presente en casi todas las versiones 3.x. Las solicitudes nominales de 128 o 256 bits de entrop\u00eda a trav\u00e9s de esta funci\u00f3n producen espacios de b\u00fasqueda efectivos de aproximadamente 2 elevado a la 39 y 2 elevado a la 47 posibilidades, lo suficientemente peque\u00f1os como para ser enumerados en hardware comercial. Las aplicaciones de monedero descendentes que utilizaron CryptoJS.lib.WordArray.random() como fuente de entrop\u00eda para frases de recuperaci\u00f3n BIP39 se ven afectadas, y un atacante que enumere el espacio de salida reducido puede recuperar las claves privadas resultantes y controlar los fondos asociados. Este problema est\u00e1 solucionado en la versi\u00f3n 4.0.0."
    }
  ],
  "id": "CVE-2026-71851",
  "lastModified": "2026-10-24T15:10:00.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71851",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-08T03:05:26.687602Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T19:18:54.390",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-331"
        },
        {
          "lang": "en",
          "value": "CWE-334"
        },
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RG76-677X-56Q9

Vulnerability from github – Published: 2026-08-07 18:48 – Updated: 2026-08-07 18:48

Summary

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Details

Summary

CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware.

Coinspect's Ill Bloom investigation confirmed that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases.

An application is affected only if it uses the vulnerable function to generate security-sensitive values.

Merely depending on crypto-js < 4.0.0 is not sufficient to be exploitable.

Details

The affected implementation used a custom variation of George Marsaglia's Multiply-With-Carry PRNG, seeded from Math.random(). It was introduced in 3.1.2-4 (June 2014, commit brix/crypto-js@ff1f003) in response to issue #7, and was present in every 3.x release except 3.2.0 and 3.2.1. That change was reverted in 3.3.0 because it was considered a breaking change, so projects tracking the 3.x line could resolve to newer versions that still contained the weak generator.

4.0.0 replaced the generator with the platform's native cryptographic API.

Applying PBKDF2, another KDF, or a cryptographic hash after the vulnerable generator does not restore missing entropy.

Proof of concept

Coinspect reproduced the attack end to end:

Reimplemented the affected WordArray.random() behavior.
Enumerated the feasible outputs of the underlying PRNG.
Converted candidate entropy values into valid BIP39 recovery phrases.
Derived private keys and addresses across the relevant derivation paths and networks.
Compared derived addresses against public blockchain data.
Recovered the private keys controlling funded addresses.

Impact

An attacker can enumerate the reduced output space and recover security-sensitive values generated through the affected function.

Coinspect documented coordinated drain waves affecting addresses derived from vulnerable recovery phrases. As of July 13, 2026, the measured lower bound of stolen assets across the two events was approximately $5M.

The consequences are persistent:

Updating an affected library or wallet does not strengthen a previously generated secret.
Importing the same recovery phrase into an updated software or hardware wallet does not remediate the issue.
Previously generated secrets may remain exploitable indefinitely.
Future deposits to an affected address may also be stolen.
Assets may remain exposed across networks or derivation paths that have not yet shown suspicious activity.

Remediation

For projects:

Upgrade crypto-js to version 4.0.0 or later. Where possible, replace CryptoJS randomness with the native Web Crypto API or Node.js crypto module.
Audit direct, downstream, and transitive dependencies for versions of crypto-js matching < 4.0.0.
Determine whether CryptoJS.lib.WordArray.random() was used to generate any security-sensitive values.
Identify the time periods and application versions during which the vulnerable generation path was present.
Treat all long-term secrets generated through an affected path as compromised and rotate them.
Notify affected users that installing an update is insufficient when a long-term secret was generated by the vulnerable code.

For wallet users: create a new wallet with a newly generated recovery phrase from a trustworthy source and migrate assets to addresses derived from it. Do not import the existing recovery phrase into the new wallet.

Public address checker

Coinspect provides a public checker for addresses identified in the known Ill Bloom exposed-address datasets:

https://illbloom.org/

Only public blockchain addresses should be entered. Users must never enter a recovery phrase, seed phrase, mnemonic, private key, password, or wallet backup file.

A match indicates that funds controlled by the same recovery phrase may be at immediate risk. A negative result only means that the submitted address was not found in the currently published datasets.

References

Ill Bloom research site and public address checker:
https://illbloom.org/
Coinspect investigation overview:
https://www.coinspect.com/blog/ill-bloom-investigation/
CryptoJS issue #7 — randomBytes is not random enough:
https://github.com/brix/crypto-js/issues/7
Commit introducing the MWC-based implementation:
https://github.com/brix/crypto-js/commit/ff1f0032ff58aedfcc44eb6aa7b2c78207a98009
Changes between CryptoJS 3.3.0 and 4.0.0:
https://github.com/brix/crypto-js/compare/3.3.0...4.0.0
Downstream ferrumnet/bip39 fork:
https://github.com/ferrumnet/bip39

Severity

9.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "crypto-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-331",
      "CWE-334",
      "CWE-338"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T18:48:59Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\n`CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities \u2014 small enough to enumerate on commodity hardware.\n\nCoinspect\u0027s [Ill Bloom](https://www.coinspect.com/blog/ill-bloom-investigation/) investigation confirmed that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases.\n\n**An application is affected only if it uses the vulnerable function to generate security-sensitive values.** \n\nMerely depending on `crypto-js \u003c 4.0.0` is not sufficient to be exploitable.\n\n### Details\n\nThe affected implementation used a custom variation of George Marsaglia\u0027s Multiply-With-Carry PRNG, seeded from `Math.random()`. It was introduced in 3.1.2-4 (June 2014, commit brix/crypto-js@ff1f003) in response to issue \\#7, and was present in every 3.x release except 3.2.0 and 3.2.1. That **change was reverted in 3.3.0** because it was considered a breaking change, so projects tracking the 3.x line could resolve to newer versions that still contained the weak generator. \n\n4.0.0 replaced the generator with the platform\u0027s native cryptographic API.\n\nApplying PBKDF2, another KDF, or a cryptographic hash after the vulnerable generator does not restore missing entropy.\n\n### Proof of concept\n\nCoinspect reproduced the attack end to end:\n\n1. Reimplemented the affected `WordArray.random()` behavior.  \n2. Enumerated the feasible outputs of the underlying PRNG.  \n3. Converted candidate entropy values into valid BIP39 recovery phrases.  \n4. Derived private keys and addresses across the relevant derivation paths and networks.  \n5. Compared derived addresses against public blockchain data.  \n6. Recovered the private keys controlling funded addresses.\n\n### Impact\n\nAn attacker can enumerate the reduced output space and recover security-sensitive values generated through the affected function.\n\nCoinspect documented coordinated drain waves affecting addresses derived from vulnerable recovery phrases. As of July 13, 2026, the measured lower bound of stolen assets across the two events was approximately $5M.\n\nThe consequences are persistent:\n\n* Updating an affected library or wallet does not strengthen a previously generated secret.  \n* Importing the same recovery phrase into an updated software or hardware wallet does not remediate the issue.  \n* Previously generated secrets may remain exploitable indefinitely.  \n* Future deposits to an affected address may also be stolen.  \n* Assets may remain exposed across networks or derivation paths that have not yet shown suspicious activity.\n\n### Remediation\n\n**For projects:**\n\n1. Upgrade `crypto-js` to version `4.0.0` or later. Where possible, replace CryptoJS randomness with the native Web Crypto API or Node.js `crypto` module.  \n2. Audit direct, downstream, and transitive dependencies for versions of `crypto-js` matching `\u003c 4.0.0`.  \n3. Determine whether `CryptoJS.lib.WordArray.random()` was used to generate any security-sensitive values.  \n4. Identify the time periods and application versions during which the vulnerable generation path was present.  \n5. Treat all long-term secrets generated through an affected path as compromised and rotate them.  \n6. Notify affected users that installing an update is insufficient when a long-term secret was generated by the vulnerable code.\n\n**For wallet users:** create a new wallet with a newly generated recovery phrase from a trustworthy source and migrate assets to addresses derived from it. Do not import the existing recovery phrase into the new wallet.\n\n### Public address checker\n\nCoinspect provides a public checker for addresses identified in the known Ill Bloom exposed-address datasets:\n\n[https://illbloom.org/](https://illbloom.org/)\n\nOnly public blockchain addresses should be entered. Users must **never enter a recovery phrase**, seed phrase, mnemonic, private key, password, or wallet backup file.\n\nA match indicates that funds controlled by the same recovery phrase may be at immediate risk. A negative result only means that the submitted address was not found in the currently published datasets.\n\n### References\n\n* Ill Bloom research site and public address checker:  \n  [https://illbloom.org/](https://illbloom.org/)  \n* Coinspect investigation overview:  \n  [https://www.coinspect.com/blog/ill-bloom-investigation/](https://www.coinspect.com/blog/ill-bloom-investigation/)  \n* CryptoJS issue \\#7 \u2014 `randomBytes is not random enough`:  \n  [https://github.com/brix/crypto-js/issues/7](https://github.com/brix/crypto-js/issues/7)  \n* Commit introducing the MWC-based implementation:  \n  [https://github.com/brix/crypto-js/commit/ff1f0032ff58aedfcc44eb6aa7b2c78207a98009](https://github.com/brix/crypto-js/commit/ff1f0032ff58aedfcc44eb6aa7b2c78207a98009)  \n* Changes between CryptoJS `3.3.0` and `4.0.0`:  \n  [https://github.com/brix/crypto-js/compare/3.3.0...4.0.0](https://github.com/brix/crypto-js/compare/3.3.0...4.0.0)  \n* Downstream `ferrumnet/bip39` fork:  \n  [https://github.com/ferrumnet/bip39](https://github.com/ferrumnet/bip39)",
  "id": "GHSA-rg76-677x-56q9",
  "modified": "2026-08-07T18:48:59Z",
  "published": "2026-08-07T18:48:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/brix/crypto-js"
    },
    {
      "type": "WEB",
      "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain"
}

UBUNTU-CVE-2026-71851 (CVE-2026-71851)

Vulnerability from osv_ubuntu – Published: 2026-08-07 19:18 – Updated: 2026-08-13 00:14 – Source website

Details

Severity

9.0 (Critical)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-71851	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-71851	REPORT
	https://github.com/brix/crypto-js/commit/b405ff59…	REPORT
	https://github.com/brix/crypto-js/security/adviso…	REPORT
	https://www.coinspect.com/blog/ill-bloom-investigation	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-cryptojs",
            "binary_version": "3.1.2+dfsg-2ubuntu0.16.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "cryptojs",
        "purl": "pkg:deb/ubuntu/cryptojs@3.1.2+dfsg-2ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg-1",
        "3.1.2+dfsg-2",
        "3.1.2+dfsg-2ubuntu0.16.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-cryptojs",
            "binary_version": "3.1.2+dfsg-2ubuntu0.18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "cryptojs",
        "purl": "pkg:deb/ubuntu/cryptojs@3.1.2+dfsg-2ubuntu0.18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg-2",
        "3.1.2+dfsg-2ubuntu0.18.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-cryptojs",
            "binary_version": "3.1.2+dfsg-2ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "cryptojs",
        "purl": "pkg:deb/ubuntu/cryptojs@3.1.2+dfsg-2ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg-2",
        "3.1.2+dfsg-2ubuntu0.20.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-cryptojs",
            "binary_version": "3.1.2+dfsg-3ubuntu0.22.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "cryptojs",
        "purl": "pkg:deb/ubuntu/cryptojs@3.1.2+dfsg-3ubuntu0.22.04.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg-3",
        "3.1.2+dfsg-3ubuntu0.22.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-cryptojs",
            "binary_version": "3.1.2+dfsg-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "cryptojs",
        "purl": "pkg:deb/ubuntu/cryptojs@3.1.2+dfsg-4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg-3",
        "3.1.2+dfsg-4"
      ]
    }
  ],
  "aliases": [],
  "details": "crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.",
  "id": "UBUNTU-CVE-2026-71851",
  "modified": "2026-08-13T00:14:08Z",
  "published": "2026-08-07T19:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-71851"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71851"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9"
    },
    {
      "type": "REPORT",
      "url": "https://www.coinspect.com/blog/ill-bloom-investigation"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-71851"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71851 (GCVE-0-2026-71851)

FKIE_CVE-2026-71851

GHSA-RG76-677X-56Q9

Summary

Details

Proof of concept

Impact

Remediation

Public address checker

References

UBUNTU-CVE-2026-71851 (CVE-2026-71851)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour