The sjcl package prior to version 1.0.9 contains a cryptographic vulnerability (CVE-2026-4258) where the function sjcl.ecc.basicKey.publicKey() fails to validate that public keys lie on the expected elliptic curve. This missing point-on-curve validation enables attackers to submit off-curve public keys to the ECDH implementation. Because the dhJavaEc() function returns the raw x-coordinate of the scalar multiplication without hashing or additional processing, it acts as a plaintext oracle. An attacker can exploit this to recover the victim's ECDH private key by analyzing the outputs from these crafted inputs. The vulnerability is classified under CWE-325 (Improper Verification of Cryptographic Signature) and has a CVSS 4.0 base score of 8.7, indicating high severity.

An attacker can recover the victim's ECDH private key by exploiting the lack of point-on-curve validation and the plaintext oracle behavior of the dhJavaEc() function. This compromises the confidentiality of cryptographic operations relying on the ECDH key, potentially allowing decryption of sensitive data or impersonation in cryptographic protocols that use sjcl for key agreement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix is currently documented. Until a fix is available, users should avoid using vulnerable versions of sjcl for ECDH operations or implement additional validation to ensure public keys are on the correct curve before processing.