Description
Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer’s ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 19.4.0
- Patched version(s): 19.4.0
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk Prototype Pollution vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype pollution in matrix-js-sdk (part 2) - CVE-2023-28427
- matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion - CVE-2022-39251
- matrix-js-sdk subject to impersonated messages due to permissive key forwarding - CVE-2022-39249
- Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
You might also like:
See something that needs correcting? Let us knowUpdated March 28, 2023