{"vulnerability": "CVE-2026-71851", "sightings": [{"uuid": "c72e6808-916c-46fe-a19e-65e39516bf29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjb5v4unw26", "content": "CVE-2026-71851 - crypto-js\nAn outdated version of CryptoJS used in wallet applications can generate weak random numbers for BIP39 recovery phrases, potentially allowing attackers to guess them. This issue\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cryptojs #npm #CVE #infosec", "creation_timestamp": "2026-08-07T19:12:05.646091Z"}, {"uuid": "124f6059-724b-4421-8b22-bd9d807ba0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmgetop3cozq3", "content": "CVE-2026-71851 - crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain\nCVE ID : CVE-2026-71851\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : crypto-js is a JavaScript library of crypto standards. ...", "creation_timestamp": "2026-08-07T20:04:08.022943Z"}, {"uuid": "2ef31926-0304-4727-be9a-cb04eb3cc024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71851", "type": "published-proof-of-concept", "source": "https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9", "content": "", "creation_timestamp": "2026-08-07T20:35:06.834983Z"}, {"uuid": "55d775ed-892a-4dc9-b302-903a890ab84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://gist.github.com/alon710/fa679955da8f3503916dff57f8688b8c", "content": "# CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71851\n\n## Summary\nA severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.\n\n## TL;DR\nLegacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-338\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Active In-The-Wild\n- **Primary Impact**: Private Key Compromise and Asset Theft\n- **Component**: CryptoJS.lib.WordArray.random()\n\n## Affected Systems\n\n- crypto-js <= 3.3.0\n- Legacy web3 wallets\n- Decentralized browser extensions using crypto-js 3.x\n- Hybrid mobile applications bundling legacy crypto-js dependencies\n- **crypto-js**: >= 3.1.2-4, < 4.0.0 (Fixed in: `4.0.0`)\n\n## Mitigation\n\n- Upgrade crypto-js dependency to version 4.0.0 or higher.\n- Implement platform-native secure random generation APIs.\n- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.\n\n**Remediation Steps:**\n1. Verify installed dependencies using npm ls crypto-js.\n2. Upgrade packages to version 4.0.0 or later.\n3. Generate new mnemonic phrases and migrate wallet assets to fresh addresses.\n\n## References\n\n- [Ill Bloom Dedicated Research & Address Checker](https://illbloom.org/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T21:31:50.457897Z"}, {"uuid": "6be479dc-b607-4296-a99e-f3b806cfd0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71851", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msk3dxl5gn23", "content": "\ud83d\udd34 CVE-2026-71851 - Critical (9)\n\ncrypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 gener...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71851/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-08T03:00:47.380865Z"}, {"uuid": "5471ff3e-3c46-42ac-987d-4672371bf477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117058006236524756", "content": "CVE-2026-71851 (CRITICAL, CVSS 9): brix crypto-js <4.0.0 uses weak RNG in WordArray.random(), risking private key recovery in wallet apps using BIP39. Upgrade to 4.0.0+ now. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffSeq #CryptoJS #InfoSec #Vulnerability", "creation_timestamp": "2026-08-08T04:30:25.909750Z"}, {"uuid": "ec632e76-0c19-4daf-bc5e-af461b4901c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-71851", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mskaecwoh72v", "content": "brix crypto-js CRITICAL flaw (CVE-2026-71851): Insufficient entropy in WordArray.random() exposes wallets to private key theft. Affected: 3.1.2-4 to <4.0.0. Upgrade to 4.0.0+ ASAP. https://radar.offseq.com/threat/cve-2026-71851-cwe-331-insufficient-entropy-in-brix-crypto-js-e5283f6c465bd95e #OffS...", "creation_timestamp": "2026-08-08T04:30:27.672500Z"}]}