Description
A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim’s client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for the room containing a malicious emote pack.
Recommendation
Update the cinny package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.10.3
- Patched version(s): 4.10.3
References
Could your website be exposed too?
SmartScanner can check your website for Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026