matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

Description

An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 19.7.0
• Patched version(s): 19.7.0

References

• GHSA-5w8r-8pgj-5jmf
• matrix.org
• security.gentoo.org
• CVE-2022-39250
• CWE-287
• CWE-322
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor - CVE-2024-42369

Tags:

npm

matrix-js-sdk