p PatchFirst

CVE-2023-28427

CVE-2023-28427 · Prototype pollution in matrix-js-sdk

This page contains facts from public vulnerability sources. Check the original advisory before updating.

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 8.2 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • matrix-js-sdk

    Versions
    • < 24.0.0: Affected

    No fix published

  • thunderbird Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:102.9.1-1

    Update to 1:102.9.1-1

  • thunderbird Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:102.9.1-1

    Update to 1:102.9.1-1

  • thunderbird Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:102.9.1-1

    Update to 1:102.9.1-1

  • matrix-js-sdk npm

    Affected ranges
    • SEMVER: < 24.0.0

    Update to 24.0.0

  • node-matrix-js-sdk Ubuntu:20.04:LTS

    Versions
    • 0.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-matrix-js-sdk Ubuntu:22.04:LTS

    Versions
    • 9.3.0+~cs9.9.16-2
    • 9.11.0+~cs9.9.16-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-matrix-js-sdk Ubuntu:24.04:LTS

    Versions
    • 9.11.0+~cs9.9.16-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →