Matrix-org vulnerabilities

Products

• Synapse 24
• Matrix-js-sdk 11
• Matrix-appservice-irc 10
• Matrix-react-sdk 8
• Matrix-rust-sdk 8
• Sydent 5
• Dendrite 4
• Gomatrixserverlib 2
• Matrix-android-sdk2 2
• Matrix-appservice-bridge 2
• Matrix-hookshot 2
• Matrix-ios-sdk 2
• Vodozemac 2

Newest

• matrix-org dendrite Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVE-2026-63097 5.3 MediumJuly 17, 2026
• matrix-org dendrite Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVE-2026-63096 6.9 MediumJuly 17, 2026
• matrix-org dendrite Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVE-2026-63095 7.1 HighJuly 17, 2026
• matrix-org matrix-sdk-ui matrix-sdk-ui: Incomplete edit validation CVE-2026-45057 Fix available 4.9 MediumJune 3, 2026
• matrix-org matrix-rust-sdk Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution CVE-2026-45056 Fix available 6.9 MediumJune 3, 2026
• matrix matrix-rust-sdk matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values CVE-2025-66622 Fix available 1.3 LowDecember 8, 2025
• matrix-org matrix-js-sdk matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2025-59160 Fix available 2.7 LowSeptember 16, 2025
• matrix-org matrix-rust-sdk matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method CVE-2025-59047 Fix available 2.7 LowSeptember 11, 2025
• matrix-org matrix-rust-sdk Matrix Rust SDK allows SQL injection in the EventCache implementation CVE-2025-53549 Fix available 5.2 MediumJuly 10, 2025
• matrix-org matrix-rust-sdk matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator CVE-2025-48937 Fix available 4.9 MediumJune 10, 2025
• matrix-org pinecone In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim CVE-2025-27155 6.1 MediumMarch 4, 2025
• matrix irc bridge, matrix-org matrix-appservice-irc +1 more Matrix IRC Bridge allows IRC command injection to own puppeted user CVE-2025-27146 Fix available 2.7 LowFebruary 25, 2025
• matrix-org matrix-hookshot matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support CVE-2025-23197 6.5 MediumJanuary 27, 2025
• matrix-org mjolnir Mjolnir v1.9.0 accepts commands from any room CVE-2025-24024 9.1 CriticalJanuary 21, 2025
• matrix-org gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib CVE-2024-52594 Fix available 4.3 MediumJanuary 16, 2025
• matrix-org matrix-appservice-irc matrix-appservice-irc allows IRC Command injection in provisioning API CVE-2024-52505 5.4 MediumNovember 14, 2024
• matrix-org matrix-js-sdk matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal CVE-2024-50336 Fix available 5.3 MediumNovember 12, 2024
• matrix-org matrix-react-sdk Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room CVE-2024-47824 Fix available 8.7 HighOctober 15, 2024
• matrix-org matrix-js-sdk matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver CVE-2024-47080 Fix available 8.7 HighOctober 15, 2024
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more A room with itself as a its predecessor will freeze matrix-js-sdk CVE-2024-42369 Fix available 4.1 MediumAugust 20, 2024
• matrix matrix-react-sdk URL preview setting for a room is controllable by the homeserver in matrix-react-sdk CVE-2024-42347 Fix available 7.7 HighAugust 6, 2024
• matrix-org matrix-rust-sdk `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk CVE-2024-40648 Fix available 5.4 MediumJuly 18, 2024
• matrix-org vodozemac Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac CVE-2024-40640 Fix available 2.9 LowJuly 17, 2024
• matrix-org matrix-appservice-irc Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to CVE-2024-39691 Fix available 4.3 MediumJuly 5, 2024
• matrix-org matrix-sdk-crypto matrix-sdk-crypto contains a log exposure of private key of the server-side key backup CVE-2024-34353 Fix available 5.5 MediumMay 13, 2024
• matrix-org vodozemac Degraded secret zeroization capabilities in vodozemac CVE-2024-34063 Fix available 2.5 LowMay 2, 2024
• matrix-org matrix-appservice-irc Truncated content of messages can be leaked from matrix-appservice-irc CVE-2024-32000 Fix available 4.3 MediumApril 11, 2024
• matrix-org matrix-rust-sdk matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity CVE-2024-52813 Fix available 4.3 MediumJanuary 7, 2024
• element-hq synapse, fedoraproject fedora +1 more Synapse vulnerable to leak of remote user device information CVE-2023-43796 Fix available 5.3 MediumOctober 31, 2023
• element-hq synapse, fedoraproject fedora +1 more matrix-synapse vulnerable to denial of service due to malicious server ACL events CVE-2023-45129 Fix available 4.9 MediumOctober 10, 2023
• matrix hookshot, matrix-org matrix-hookshot +1 more Sandbox escape for instances that have enabled transformation functions in matrix-hookshot CVE-2023-43656 5.6 MediumSeptember 27, 2023
• element-hq synapse, fedoraproject fedora +1 more Improper validation of receipts allows forged read receipts in matrix synapse CVE-2023-42453 Fix available 3.1 LowSeptember 26, 2023
• element-hq synapse, fedoraproject fedora +1 more Temporary storage of plaintext passwords during password changes in matrix synapse CVE-2023-41335 Fix available 3.7 LowSeptember 26, 2023
• matrix irc bridge, matrix-org matrix-appservice-irc +1 more matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVE-2023-38700 Fix available 3.5 LowAugust 4, 2023
• matrix matrix-appservice-bridge matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs CVE-2023-38691 Fix available 5.0 MediumAugust 4, 2023
• matrix irc bridge, matrix-org matrix-appservice-irc +1 more matrix-appservice-irc IRC command injection via admin commands containing newlines CVE-2023-38690 Fix available 5.8 MediumAugust 4, 2023
• matrix sydent Sydent does not verify email server certificates CVE-2023-38686 Fix available 9.3 CriticalJuly 31, 2023
• matrix-org matrix-react-sdk Cross site scripting in Export Chat feature CVE-2023-37259 Fix available 6.1 MediumJuly 18, 2023
• element-hq synapse URL deny list bypass via oEmbed and image URLs when generating previews in Synapse CVE-2023-32683 Fix available 3.5 LowJune 6, 2023
• element-hq synapse Improper checks for deactivated users during login in synapse CVE-2023-32682 Fix available 5.4 MediumJune 6, 2023
• element-hq synapse Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVE-2023-32323 Fix available 5.0 MediumMay 24, 2023
• element-hq synapse Synapse Denial of service due to incorrect application of event authorization rules during state resolution CVE-2022-39374 Fix available 6.5 MediumMay 24, 2023
• element-hq synapse Synapse does not apply enough checks to servers requesting auth events of events in a room CVE-2022-39335 Fix available 5.0 MediumMay 24, 2023
• matrix-org matrix-react-sdk matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting CVE-2023-30609 Fix available 5.4 MediumApril 25, 2023
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more matrix-js-sdk vulnerable to invisible eavesdropping in group calls CVE-2023-29529 Fix available 5.0 MediumApril 14, 2023
• matrix-org matrix-react-sdk Prototype pollution in matrix-react-sdk CVE-2023-28103 Fix available 8.2 HighMarch 28, 2023
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more Prototype pollution in matrix-js-sdk CVE-2023-28427 Fix available 8.2 HighMarch 28, 2023
• matrix-org matrix-react-sdk, matrix react sdk +1 more Prototype pollution in matrix-react-sdk CVE-2022-36060 Fix available 8.2 HighMarch 28, 2023
• matrix-org matrix-appservice-irc, matrix irc bridge +1 more matrix-appservice-irc PgDataStore.ts sql injection CVE-2022-3971 Fix available 4.6 MediumNovember 13, 2022
• matrix matrix-rust-sdk When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder CVE-2022-39252 Fix available 8.6 HighSeptember 29, 2022
• Show olderLoading…