matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Description

An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 19.7.0
• Patched version(s): 19.7.0

References

• GHSA-r48r-j8fx-mq2c
• matrix.org
• security.gentoo.org
• CVE-2022-39251
• CWE-287
• CWE-322
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) 9 - Vulnerability
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) 8 - Vulnerability

Tags:

npm

matrix-js-sdk