Executive brief
sm-crypto is a JavaScript library that implements Chinese cryptographic algorithms, including SM2 digital signatures. A signature malleability flaw allows an attacker to forge alternate valid signatures for previously signed messages without knowing the private key, undermining the authenticity guarantees of any system relying on SM2 signatures for transaction validation, contract enforcement, or audit trails.
Technical details
The vulnerability is a signature malleability issue in SM2 signature verification (CWE-347: Improper Verification of Cryptographic Signature). An attacker can derive a new valid signature from an existing valid signature for the same message, exploiting a flaw in the SM2-DSA implementation. The attack is network-reachable and requires no authentication or user interaction. An attacker can forge signatures to bypass integrity checks, impersonate legitimate signers, or create duplicate transactions. The vulnerability was patched in version 0.3.14; all earlier versions are affected.
Affected products
- JuneAndGreen sm-crypto < 0.3.14
Timeline
- 2026-01-21: disclosed: Advisory GHSA-qv7w-v773-3xqm published
- 2026-01-21: patched: Version 0.3.14 fixes the vulnerability