matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Description

matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client’s homeserver.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 34.11.1
• Patched version(s): 34.11.1

References

• GHSA-xvg8-m4x3-w6xr
• spec.matrix.org
• lists.debian.org
• CVE-2024-50336
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver - CVE-2021-40823
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Vega allows Cross-site Scripting via the vlSelectionTuples function (GHSA-mp7w-mhcv-673j) - CVE-2025-25304
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080

Tags:

npm

matrix-js-sdk