The crypto-js JavaScript library versions before 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom Multiply-With-Carry pseudorandom number generator seeded from Math.random(), which is not cryptographically secure. This results in effective entropy search spaces of approximately 2^39 for 128-bit requests and 2^47 for 256-bit requests, which are small enough to be enumerated on commodity hardware. Wallet applications that use this function as the entropy source for BIP39 recovery phrases are vulnerable to private key recovery attacks. The vulnerability was introduced in version 3.1.2-4 and affects nearly all 3.x releases. The issue is resolved in version 4.0.0.

An attacker who enumerates the reduced output space of the insecure random number generator can recover private keys derived from BIP39 recovery phrases generated using CryptoJS.lib.WordArray.random(). This leads to full compromise of the associated cryptocurrency wallets, including confidentiality, integrity, and availability impacts. The CVSS score of 9 indicates critical severity with network attack vector, high complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Upgrade to crypto-js version 4.0.0 or later, where the insecure pseudorandom number generator has been replaced with a cryptographically secure source. Avoid using CryptoJS.lib.WordArray.random() from versions prior to 4.0.0 for cryptographic entropy, especially in wallet or key generation contexts. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 4.0.0.