GitHub Advisoryadvisory · npm

GHSA-8796-gc9j-63rv File upload local preview can run embedded scripts after user interaction

MEDIUM Published 2021-05-17 Modified 2021-10-05 Official page ↗
Ecosystem
npm
Packages
matrix-react-sdk
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2021-05-17

Affected packages

• npm matrix-react-sdk: < 3.21.0 → fixed in 3.21.0

Description

Impact When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. Patches This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0. Workarounds There are no known workarounds.

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References