CVE-2022-36060

Prototype pollution in matrix-react-sdk

8.2 HighFix available

CVE-2022-36060 is a high vulnerability (CVSS 8.2) in Matrix-org Matrix-react-sdk, published March 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in matrix-react-sdk 3.53.0.

What does this mean?

Severity: 8.2 HighCVSS 3.1, CVE List
Exploit chance: 0.91%EPSS, 60th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 3.53.0matrix-react-sdk +9 more

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.91%Up 0.9 points since Mar 29, 2023

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`matrix-react-sdk` npm	before 3.53.0	3.53.0
`element-web` Alpine:v3.18	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.19	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.20	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.21	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.22	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.23	before 1.11.4-r0	1.11.4-r0
`element-web` Alpine:v3.24	before 1.11.4-r0	1.11.4-r0
`riot-web` Alpine:v3.16	before 1.11.4-r0	1.11.4-r0
`riot-web` Alpine:v3.17	before 1.11.4-r0	1.11.4-r0

What each source reports

CVE List Score used8.2

Prototype pollution in matrix-react-sdk

Record: CVE-2022-36060
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-1321
Updated: 2026-11-02

EUVDEUVD-2023-08378.2

Record: EUVD-2023-0837
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2x9c-qwgf-94xr7.2

matrix-react-sdk Prototype pollution vulnerability

Impact

Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.

Patches

This is fixed in matrix-react-sdk 3.53.0

Workarounds

There are no workarounds. Please upgrade immediately.

References

https://learn.snyk.io/lessons/prototype-pollution/javascript/

For more information

If you have any questions or comments about this advisory please email us at security at matrix.org.

Record: GHSA-2x9c-qwgf-94xr
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-1321
Updated: 2026-11-02

NVD8.2

Record: CVE-2022-36060
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1321
Updated: 2026-11-02

OSVALPINE-CVE-2022-360605.3

Record: ALPINE-CVE-2022-36060
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

OSV8.2