sm-crypto’s default SM2 key generation path in Node.js uses a predictable random number generator that draws from Math.random() and the current time. This deterministic seed allows an attacker who can observe the process’s Math.random() outputs and estimate the generation time to reconstruct the seed, recover the SM2 private key and predict the signing scalars, enabling forged signatures. The vulnerability leads to full private key exposure and the ability to impersonate legitimate signatures.

All Node.js installations that employ JuneAndGreen’s sm-crypto library before version 0.5.0 are affected. Projects that call sm2.generateKeyPairHex() without arguments rely on the insecure seed source and therefore expose their keys. The issue is absent in sm-crypto 0.5.0 and later, where a secure random source is used.

The CVSS score of 9.1 indicates critical severity, and while EPSS is not available, the lack of a public exploit and the non‑KEV status suggest the risk comes from the ease of local exploitation rather than widespread attacks. An attacker needs the ability to monitor the target’s Math.random() output or to predict the time window of key generation; this is feasible in compromised or shared hosting environments. Consequently, the likelihood of exploitation is moderate, but the potential impact is severe due to key compromise and signature forgery.