Skip to main content
cve.nowby Sazabi
← npm
npmPackage

matrix-react-sdk

8 known vulnerabilities (4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 4 high, 3 medium, 1 low
Registry
npm

Advisories 8

  • Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room

    Affected: from 3.18.0, fixed in 3.102.0.

  • URL preview setting for a room is controllable by the homeserver in matrix-react-sdk

    Affected: fixed in 3.105.1.

  • CVE-2023-37259Medium 6.1

    Cross site scripting in Export Chat feature

    Affected: from 3.32.0, fixed in 3.76.0.

  • CVE-2023-30609Medium 5.4

    matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

    Affected: fixed in 3.71.0.

  • Prototype pollution in matrix-react-sdk

    Affected: fixed in 3.53.0.

  • Prototype pollution in matrix-react-sdk

    Affected: fixed in 3.69.0.

  • CVE-2021-32622Medium 4.2

    File upload local preview can run embedded scripts after user interaction

    Affected: fixed in 3.21.0.

  • User content sandbox can be confused into opening arbitrary documents

    Affected: fixed in 3.15.0.