matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Description

matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 38.2.0
• Patched version(s): 38.2.0

References

• GHSA-mp7c-m3rh-r56v
• www.npmjs.com
• CVE-2025-59160
• CWE-20
• CWE-345
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Modified package published to npm, containing malware that exfiltrates private key material - CVE-2024-54134
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• Prototype pollution in ag-grid-community via the _.mergeDeep function (GHSA-876p-c77m-x2hc) - CVE-2024-38996
• matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor - CVE-2024-42369

Tags:

npm

matrix-js-sdk