Detections
Analytics

SCA: security update for sm-crypto (GHSA-hpwg-xg7m-3p6m)

high Tenable Cloud Security Plugin ID 436872

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A
 signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto prior to
 version 0.4.0. Under default configurations, an attacker can forge valid signatures for arbitrary public
 keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the message
 associated with the forged signature to satisfy specific formatting requirements. Version 0.4.0 patches
 the issue. (CVE-2026-23965)

See Also

https://github.com/advisories/GHSA-hpwg-xg7m-3p6m

Plugin Details

Severity: High

ID: 436872

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 1/21/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-23965

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/21/2026

Vulnerability Publication Date: 1/21/2026

Reference Information

CVE: CVE-2026-23965

cwe: CWE-347