GHSA-2x9c-qwgf-94xr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2x9c-qwgf-94xr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-2x9c-qwgf-94xr/GHSA-2x9c-qwgf-94xr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2x9c-qwgf-94xr
- Aliases
- Published
- 2023-03-28T19:57:57Z
- Modified
- 2023-11-08T04:09:59Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- matrix-react-sdk Prototype pollution vulnerability
- Details
-
Impact
Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.
Patches
This is fixed in matrix-react-sdk 3.53.0
Workarounds
There are no workarounds. Please upgrade immediately.
References
https://learn.snyk.io/lessons/prototype-pollution/javascript/
For more information
If you have any questions or comments about this advisory please email us at security at matrix.org.
- Database specific
{ "cwe_ids": [ "CWE-1321" ], "github_reviewed": true, "github_reviewed_at": "2023-03-28T19:57:57Z", "nvd_published_at": "2023-03-28T21:15:00Z", "severity": "HIGH" }- References
Affected packages
npm / matrix-react-sdk
Package
- Name
- matrix-react-sdk
- View open source insights on deps.dev
- Purl
- pkg:npm/matrix-react-sdk