GitHub Advisoryadvisory · npm

GHSA-cg57-p69r-3m7p Improper file handling in matrix-react-sdk

MEDIUM Published 2022-02-10 Modified 2021-05-19 Official page ↗
Aliases
CVE-2021-32622
Ecosystem
npm
Packages
matrix-react-sdk
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-434, CWE-74
Reviewed
2021-05-19

Affected packages

• npm matrix-react-sdk: < 3.21.0 → fixed in 3.21.0

Description

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

Related

Alias · CVE (1)

  • CVE-2021-32622 Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References