matrix-js-sdk vulnerable to invisible eavesdropping in group calls

Description

An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 24.1.0
• Patched version(s): 24.1.0

References

• GHSA-6g67-q39g-r79q
• CVE-2023-29529
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Bootstrap Cross-site Scripting vulnerability (GHSA-pj7m-g53m-7638) - CVE-2018-14041
• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414

Tags:

npm

matrix-js-sdk