158 matches found
CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...
CLEANSTART-2024-IV81629 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript
Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript...
CLEANSTART-2024-KH83435 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript
Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript...
CVE-2023-29529
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker...
Improper Input Validation
matrix-js-sdk is vulnerable to Improper Input Validation. The vulnerability is due to inadequate validation in the MatrixClient::getJoinedRooms function, which allows an attacker to replace a tombstoned room with an unrelated attacker-controlled room...
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Impact matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. Patches The issue has been patched and users should upgrade to...
CVE-2025-59160
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...
@a.agiir/cinny (>=0.0.1, <=0.0.2), @airgap/beacon-sdk (>=0.0.1-beta.0, <=0.3.0) +92 more potentially affected by CVE-2025-59160 via matrix-js-sdk (>=0.0.4, <=37.13.0)
matrix-js-sdk NPM version =0.0.4, =0.0.1, =0.0.1-beta.0, =0.0.34, =1.3.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =1.1.0, =1.2.34 and more Source cves: CVE-2025-59160 Source advisory: MEND:CVE-2025-59160...
CVE-2025-59160 matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...
CVE-2025-59160: Insufficient Verification of Data Authenticity
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...
CVE-2024-42369
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This...
Linux Distros Unpatched Vulnerability : CVE-2024-50336
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via...
Linux Distros Unpatched Vulnerability : CVE-2021-40823
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an...
Linux Distros Unpatched Vulnerability : CVE-2023-29529
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can...
Linux Distros Unpatched Vulnerability : CVE-2023-28427
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can...
Linux Distros Unpatched Vulnerability : CVE-2022-36059
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can...
Linux Distros Unpatched Vulnerability : CVE-2024-42369
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the...
Linux Distros Unpatched Vulnerability : CVE-2024-47080
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method...
