Security readout for executives and security teams
Plain-English summary
sjcl versions before 1.0.9 may accept malicious elliptic-curve public keys without validating them. In applications that perform ECDH with attacker-controlled keys, repeated crafted requests and observable outputs could reveal a victim’s private key, compromising protected information. The reported impact is confidentiality loss, not service disruption or data modification.
Executive priority
Prioritize remediation for internet-reachable or partner-facing systems that process externally supplied ECDH keys. Private-key recovery can undermine confidentiality beyond a single transaction, particularly where keys are reused. Systems without the affected ECDH path are lower priority but still require dependency verification. Treat the upgrade and exposure assessment as urgent, while avoiding claims of active attacks.
Technical view
The sjcl.ecc.basicKey.publicKey() implementation lacks point-on-curve validation. An attacker can supply crafted off-curve public keys and analyze ECDH results to recover the victim’s private scalar. Risk is increased because dhJavaEc() returns the raw multiplication result’s x-coordinate without hashing, exposing an oracle without requiring decryption feedback. Versions before 1.0.9 are affected.
Likely exposure
Exposure requires sjcl before 1.0.9 and a reachable workflow performing ECDH with public keys influenced by an attacker. Applications merely including sjcl, but not using the affected ECC key-agreement path, may not be exploitable. Both the npm package and org.webjars.npm:sjcl dependency should be checked, including bundled client assets.
Exploitation context
The supplied record is not in CISA KEV, and the cited sources do not establish active exploitation. Public technical material and a repository fix are referenced, indicating practical research awareness. Exploitation requires interaction with an affected ECDH workflow and observation of its returned outputs; no authentication or user interaction is reflected in the supplied CVSS vector.
Researcher notes
CWE-347 and CWE-325 are assigned. CVSS 4.0 is 8.7 with network access, low complexity, no privileges, and no user interaction; confidentiality impact is high. The decisive exposure questions are whether attacker-controlled points reach scalar multiplication and whether outputs reveal the raw x-coordinate. The supplied affected-version metadata is clearer in the description than its placeholder version arrays.
Mitigation direction
- Upgrade sjcl to version 1.0.9 or later after compatibility testing.
- Update org.webjars.npm:sjcl where it packages a vulnerable sjcl release.
- Restrict untrusted public keys from affected ECDH workflows until upgrades are complete.
- Review vendor guidance and the referenced patch for validation requirements.
- Assess whether exposed long-lived ECDH private keys should be rotated.
Validation and detection
- Inventory direct, transitive, WebJar, and bundled sjcl versions.
- Identify calls to sjcl.ecc.basicKey.publicKey() and dhJavaEc().
- Confirm whether external parties can supply ECDH public keys.
- Confirm whether raw or derived ECDH outputs are externally observable.
- Test that malformed off-curve public keys are rejected after remediation.
- Verify deployed artifacts contain sjcl 1.0.9 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-325: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-347: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-4258 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——snykCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P3.93.6snykVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-JS-SJCL-15369617CVE reference, snyk
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15751243CVE reference, snyk
- https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47CVE reference, snyk
- https://github.com/bitwiseshiftleft/sjcl/blob/master/core/ecc.js%23L454-L461CVE reference, snyk
- https://github.com/bitwiseshiftleft/sjcl/commit/ee307459972442a17beebc29dc331fffd8aff796CVE reference, snyk
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Cryptographic Step
Missing Cryptographic Step represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.