CVE-2026-71851— crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Quick assessment
Affected
brix crypto-js
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Brix crypto-js是Brix组织开源的一款JavaScript加密标准库。 Brix crypto-js 4.0.0之前版本存在加密问题漏洞，该漏洞源于CryptoJS.lib.WordArray.random()使用自定义的Multiply-With-Carry伪随机数生成器并以Math.random()作为种子，而非加密安全源，导致生成的熵不足，可能使攻击者枚举缩减的输出空间，恢复私钥并控制相关资金。
Possible ATT&CK Techniques 1 AI
T1552 · Unsecured Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-71851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Source: CVE Program / CVE List V5
Vulnerability Description
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息熵不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Brix crypto-js 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Brix crypto-js是Brix组织开源的一款JavaScript加密标准库。 Brix crypto-js 4.0.0之前版本存在加密问题漏洞，该漏洞源于CryptoJS.lib.WordArray.random()使用自定义的Multiply-With-Carry伪随机数生成器并以Math.random()作为种子，而非加密安全源，导致生成的熵不足，可能使攻击者枚举缩减的输出空间，恢复私钥并控制相关资金。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-71851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 9122 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-71851
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71851 (1)
Vendor Advisories for CVE-2026-71851 (1)
Security Blog Posts for CVE-2026-71851 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-71851
No comments yet