GitHub Advisoryadvisory · npm

GHSA-2x9c-qwgf-94xr matrix-react-sdk Prototype pollution vulnerability

HIGH Published 2023-03-28 Modified 2023-03-28 Official page ↗
Aliases
CVE-2022-36060
Ecosystem
npm
Packages
matrix-react-sdk
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2023-03-28

Affected packages

• npm matrix-react-sdk: < 3.53.0 → fixed in 3.53.0

Description

Impact Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. Patches This is fixed in matrix-react-sdk 3.53.0 Workarounds There are no workarounds. Please upgrade immediately. References https://learn.snyk.io/lessons/prototype-pollution/javascript/ For more information If you have any questions or comments about this advisory please email us at security at matrix.org.

Related

Alias · CVE (1)

  • CVE-2022-36060 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References