CVE-2021-21320

2021-03-0203:15:13

Google

osv.dev

npm package

matrix sdk

react javascript

security vulnerability

content sandbox

user data

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

38.2%

JSON

matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a blob origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.