Description
matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 38.2.0
- Patched version(s): 38.2.0
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk has insufficient validation when considering a room to be upgraded by another and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
- matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor - CVE-2024-42369
- matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver - CVE-2021-40823
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - CVE-2026-34750
You might also like:
See something that needs correcting? Let us knowUpdated September 22, 2025