CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

matrix-react-sdk (>=3.69.0, <=3.69.1) potentially affected by CVE-2023-29529 via matrix-js-sdk (24.0.0)

matrix-js-sdk NPM version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-js-sdk and may be impacted: - matrix-react-sdk =3.69.0, =3.69.1 Source cves: CVE-2023-29529 Source advisory: OSV:GHSA-6G67-Q39G-R79Q...

Prototype Pollution

matrix-react-sdk is vulnerable to Prototype Pollution. The vulnerability exists because, in certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype which may lead to an application crash...

Prototype pollution in matrix-react-sdk

Impact In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is part 2, where...

CVE-2022-36060

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

Design/Logic Flaw

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

CVE-2022-36060 Prototype pollution in matrix-react-sdk

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

CVE-2022-36060 Prototype pollution in matrix-react-sdk

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

CVE-2022-36060

CVE-2022-36060 concerns prototype pollution in matrix-react-sdk. Connected sources describe that, in certain configurations, specially crafted strings in data sent to the SDK could modify Object.prototype, disrupting normal rendering of rooms/events and potentially causing denial of service or lo...

CVE-2023-28103 Prototype pollution in matrix-react-sdk

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and...

CVE-2023-28103 Prototype pollution in matrix-react-sdk

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and...

GHSA-2X9C-QWGF-94XR matrix-react-sdk Prototype pollution vulnerability

Impact Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. Patches...

matrix-react-sdk (>=3.48.0-rc.1, <=3.52.0) potentially affected by CVE-2022-36059 via matrix-js-sdk (>=19.0.0, <=19.3.0-rc.2)

matrix-js-sdk NPM version =19.0.0, =3.48.0-rc.1, =3.52.0 Source cves: CVE-2022-36059 Source advisory: OSV:GHSA-RFV9-X7HH-XC32...

matrix-react-sdk 安全漏洞

Travis Ralston matrix-react-sdk is a Travis Ralston open source application. It is used to insert the Matrix chat/voice client into a web page. A security vulnerability exists in matrix-react-sdk, which originates from data sent from a remote server that could result in some functionality being...

matrix-react-sdk 安全漏洞

Travis Ralston matrix-react-sdk is a Travis Ralston open source application. It is used to insert the Matrix chat/voice client into web pages. A security vulnerability exists in matrix-react-sdk versions prior to 3.53.0, which stems from an event sent using a special string in a critical location...

PT-2023-21561 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions prior to 3.69.0 Description: The issue arises when data sent by remote servers contains special strings in key locations, potentially modifying the Object.prototype and disrupting the functionality of matrix-react-sd...

PT-2023-13454 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions prior to 3.53.0 Description: Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remaind...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39250 via matrix-js-sdk (>=19.0.0, <=19.6.0-rc.1)

matrix-js-sdk NPM version =19.0.0, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39250 Source advisory: OSV:GHSA-5W8R-8PGJ-5JMF...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39251 via matrix-js-sdk (>=19.0.0, <=19.6.0-rc.1)

matrix-js-sdk NPM version =19.0.0, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39251 Source advisory: OSV:GHSA-R48R-J8FX-MQ2C...

matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) potentially affected by CVE-2022-39249 via matrix-js-sdk (>=19.0.0, <=19.6.0-rc.1)

matrix-js-sdk NPM version =19.0.0, =3.48.0-rc.1, =3.55.0 Source cves: CVE-2022-39249 Source advisory: OSV:GHSA-6263-X97C-C4GG...