Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Description

A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim’s client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for the room containing a malicious emote pack.

Recommendation

Update the cinny package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.10.3
• Patched version(s): 4.10.3

References

• GHSA-j944-w549-3453
• CVE-2026-42553
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
• Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

cinny