Matrix-org Matrix-js-sdk vulnerabilities

• matrix-org matrix-js-sdk matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2025-59160 Fix available 2.7 LowSeptember 16, 2025
• matrix-org matrix-js-sdk matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal CVE-2024-50336 Fix available 5.3 MediumNovember 12, 2024
• matrix-org matrix-js-sdk matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver CVE-2024-47080 Fix available 8.7 HighOctober 15, 2024
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more A room with itself as a its predecessor will freeze matrix-js-sdk CVE-2024-42369 Fix available 4.1 MediumAugust 20, 2024
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more matrix-js-sdk vulnerable to invisible eavesdropping in group calls CVE-2023-29529 Fix available 5.0 MediumApril 14, 2023
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more Prototype pollution in matrix-js-sdk CVE-2023-28427 Fix available 8.2 HighMarch 28, 2023
• matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVE-2022-39250 Fix available 8.6 HighSeptember 29, 2022
• matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVE-2022-39251 Fix available 8.6 HighSeptember 28, 2022
• matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVE-2022-39249 Fix available 7.5 HighSeptember 28, 2022
• matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix Javascript SDK improper beacon events can cause availability issues CVE-2022-39236 Fix available 4.3 MediumSeptember 28, 2022
• matrix-org matrix-js-sdk, matrix javascript sdk +1 more Prototype pollution in matrix-js-sdk CVE-2022-36059 Fix available 8.2 HighSeptember 1, 2022