Lucene search
GoogleOSV:GHSA-52MQ-6JCV-J79XHistoryMar 03, 2021 - 2:23 a.m.
User content sandbox can be confused into opening arbitrary documents
2021-03-0302:23:56
Google
osv.dev
9
0.001 Low
EPSS
Percentile
38.4%
Impact
The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a blob origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.
Patches
This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.
Workarounds
There are no known workarounds.
| CPE | Name | Operator | Version |
|---|---|---|---|
| matrix-react-sdk | lt | 3.15.0 |
Related
prion
prion
Code injection
2021-03-02 03:15:00
cvelist
cvelist
cve
cve
CVE-2021-21320
2021-03-02 03:15:13
veracode
veracode
Sandbox Restrictions Bypass
2021-03-03 02:54:55
osv
osv
CVE-2021-21320
2021-03-02 03:15:13
nvd
nvd
CVE-2021-21320
2021-03-02 03:15:13
nodejs
nodejs
Sandbox Breakout
2021-03-03 02:27:35
github
github
User content sandbox can be confused into opening arbitrary documents
2021-03-03 02:23:56