Prototype pollution in matrix-js-sdk (part 2)

Description

In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.

(This is part 2, where CVE-2022-36059 / GHSA-rfv9-x7hh-xc32 is part 1.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 24.0.0
• Patched version(s): 24.0.0

References

• GHSA-mwq8-fjpf-c2gr
• matrix.org
• lists.debian.org
• www.debian.org
• security.gentoo.org
• CVE-2023-28427
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059
• matrix-js-sdk vulnerable to invisible eavesdropping in group calls - CVE-2023-29529
• plotly.js prototype pollution vulnerability - CVE-2023-46308
• Prototype Pollution in NASA Open MCT - CVE-2023-45282

Tags:

npm

matrix-js-sdk