Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/233677?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/233677?format=api", "purl": "pkg:npm/matrix-react-sdk@0.12.0-rc.7", "type": "npm", "namespace": "", "name": "matrix-react-sdk", "version": "0.12.0-rc.7", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "3.105.1", "latest_non_vulnerable_version": "3.105.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17381?format=api", "vulnerability_id": "VCID-1g1f-1x88-tbg5", "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nmatrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00483", "scoring_system": "epss", "scoring_elements": "0.65282", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65361", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65424", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65413", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65396", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65451", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65434", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65449", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65438", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65402", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65429", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65443", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.6537", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01152", "scoring_system": "epss", "scoring_elements": "0.78584", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609", "reference_id": "CVE-2023-30609", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609" }, { "reference_url": "https://github.com/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv83-x443-7rmw" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57322?format=api", "purl": "pkg:npm/matrix-react-sdk@3.71.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.71.0" } ], "aliases": [ "CVE-2023-30609", "GHSA-xv83-x443-7rmw" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1g1f-1x88-tbg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16964?format=api", "vulnerability_id": "VCID-3s7z-6bqr-rqd1", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69358", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69493", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69487", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69481", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69429", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69447", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69436", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69388", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69338", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69397", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69411", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69426", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69341", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69404", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103", "reference_id": "CVE-2023-28103", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56643?format=api", "purl": "pkg:npm/matrix-react-sdk@3.69.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1g1f-1x88-tbg5" }, { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.69.0" } ], "aliases": [ "CVE-2023-28103", "GHSA-6g43-88cp-w5gv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3s7z-6bqr-rqd1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42048?format=api", "vulnerability_id": "VCID-4kgp-rhzw-dqhu", "summary": "User content sandbox can be confused into opening arbitrary documents\n### Impact\n\nThe user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a `blob` origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.\n\n### Patches\n\nThis has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.\n\n### Workarounds\n\nThere are no known workarounds.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21320", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.391", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39515", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39429", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39485", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.395", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39511", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39473", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39455", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39507", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39479", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39394", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39199", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39182", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.3933", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39492", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21320" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/pull/5657", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/pull/5657" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21320", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21320" }, { "reference_url": "https://www.npmjs.com/package/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/package/matrix-react-sdk" }, { "reference_url": "https://github.com/advisories/GHSA-52mq-6jcv-j79x", "reference_id": "GHSA-52mq-6jcv-j79x", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-52mq-6jcv-j79x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/75913?format=api", "purl": "pkg:npm/matrix-react-sdk@3.15.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1g1f-1x88-tbg5" }, { "vulnerability": "VCID-3s7z-6bqr-rqd1" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-ybpz-t956-k7fb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.15.0" } ], "aliases": [ "CVE-2021-21320", "GHSA-52mq-6jcv-j79x" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4kgp-rhzw-dqhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15845?format=api", "vulnerability_id": "VCID-k3ft-j7d1-nkh7", "summary": "Matrix SDK for React's URL preview setting for a room is controllable by the homeserver\n### Impact\nA malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server.\n\nEven if the CVSS score would be 4.1 ([AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N&version=3.1)) the maintainer classifies this as High severity issue.\n\n### Patches\nThis was patched in matrix-react-sdk 3.105.1.\n\n### Workarounds\nDeployments that trust their homeservers, as well as closed federations of trusted servers, are not affected.\n\n### References\nN/A.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.7343", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73535", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73537", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73526", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73492", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73499", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73476", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73453", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73439", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73402", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73407", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.7349", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73448", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73456", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347" }, { "reference_url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "GHSA-f83w-wqhc-cfp4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55117?format=api", "purl": "pkg:npm/matrix-react-sdk@3.105.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.105.1" } ], "aliases": [ "CVE-2024-42347", "GHSA-f83w-wqhc-cfp4" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "6.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k3ft-j7d1-nkh7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16954?format=api", "vulnerability_id": "VCID-ybpz-t956-k7fb", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62213", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62248", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62255", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62238", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62228", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62243", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62236", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62192", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63167", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63138", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63132", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63184", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63201", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63219", "published_at": "2026-04-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060", "reference_id": "CVE-2022-36060", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060" }, { "reference_url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T19:56:40Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56627?format=api", "purl": "pkg:npm/matrix-react-sdk@3.53.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1g1f-1x88-tbg5" }, { "vulnerability": "VCID-3s7z-6bqr-rqd1" }, { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.53.0" } ], "aliases": [ "CVE-2022-36060", "GHSA-2x9c-qwgf-94xr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ybpz-t956-k7fb" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@0.12.0-rc.7" }