Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/292034?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/292034?format=api", "purl": "pkg:npm/matrix-react-sdk@0.3.0", "type": "npm", "namespace": "", "name": "matrix-react-sdk", "version": "0.3.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "3.105.1", "latest_non_vulnerable_version": "3.105.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54128?format=api", "vulnerability_id": "VCID-7zqg-t7kf-uqhg", "summary": "Insufficient Verification of Data Authenticity\nmatrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21320", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39251", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39214", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39202", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39229", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39256", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00179", "scoring_system": "epss", "scoring_elements": "0.39163", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21320" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/pull/5657", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/pull/5657" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x" }, { "reference_url": "https://www.npmjs.com/package/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/package/matrix-react-sdk" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21320", "reference_id": "CVE-2021-21320", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21320" }, { "reference_url": "https://github.com/advisories/GHSA-52mq-6jcv-j79x", "reference_id": "GHSA-52mq-6jcv-j79x", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-52mq-6jcv-j79x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/79878?format=api", "purl": "pkg:npm/matrix-react-sdk@3.15.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bs36-6f91-euhe" }, { "vulnerability": "VCID-nmnn-3ved-e3f8" }, { "vulnerability": "VCID-syjq-9gqf-47h9" }, { "vulnerability": "VCID-v2zw-kzp5-s3fd" }, { "vulnerability": "VCID-v528-sdjx-h3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.15.0" } ], "aliases": [ "CVE-2021-21320", "GHSA-52mq-6jcv-j79x" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7zqg-t7kf-uqhg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55648?format=api", "vulnerability_id": "VCID-bs36-6f91-euhe", "summary": "Matrix SDK for React's URL preview setting for a room is controllable by the HS\nA malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73852", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73825", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73842", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73856", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73851", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347", "reference_id": "CVE-2024-42347", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347" }, { "reference_url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "GHSA-f83w-wqhc-cfp4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "GHSA-f83w-wqhc-cfp4", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/82354?format=api", "purl": "pkg:npm/matrix-react-sdk@3.105.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.105.1" } ], "aliases": [ "CVE-2024-42347", "GHSA-f83w-wqhc-cfp4" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "6.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bs36-6f91-euhe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44778?format=api", "vulnerability_id": "VCID-nmnn-3ved-e3f8", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00762", "scoring_system": "epss", "scoring_elements": "0.73752", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00762", "scoring_system": "epss", "scoring_elements": "0.73762", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00762", "scoring_system": "epss", "scoring_elements": "0.73735", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00762", "scoring_system": "epss", "scoring_elements": "0.73765", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00762", "scoring_system": "epss", "scoring_elements": "0.73761", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103", "reference_id": "CVE-2023-28103", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64441?format=api", "purl": "pkg:npm/matrix-react-sdk@3.69.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4zyy-8bxy-9ygp" }, { "vulnerability": "VCID-bs36-6f91-euhe" }, { "vulnerability": "VCID-ttnv-yue6-1bhr" }, { "vulnerability": "VCID-v528-sdjx-h3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.69.0" } ], "aliases": [ "CVE-2023-28103", "GHSA-6g43-88cp-w5gv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nmnn-3ved-e3f8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44772?format=api", "vulnerability_id": "VCID-syjq-9gqf-47h9", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43747", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43716", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43786", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43796", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43772", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00212", "scoring_system": "epss", "scoring_elements": "0.43737", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060", "reference_id": "CVE-2022-36060", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060" }, { "reference_url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T19:56:40Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64431?format=api", "purl": "pkg:npm/matrix-react-sdk@3.53.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4zyy-8bxy-9ygp" }, { "vulnerability": "VCID-bs36-6f91-euhe" }, { "vulnerability": "VCID-nmnn-3ved-e3f8" }, { "vulnerability": "VCID-ttnv-yue6-1bhr" }, { "vulnerability": "VCID-v528-sdjx-h3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.53.0" } ], "aliases": [ "CVE-2022-36060", "GHSA-2x9c-qwgf-94xr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-syjq-9gqf-47h9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54491?format=api", "vulnerability_id": "VCID-v2zw-kzp5-s3fd", "summary": "Unrestricted Upload of File with Dangerous Type\nMatrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page., when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32622", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38558", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38603", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38593", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38621", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38649", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38647", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32622" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/pull/5981", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/pull/5981" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv" }, { "reference_url": "https://www.npmjs.com/package/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/package/matrix-react-sdk" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32622", "reference_id": "CVE-2021-32622", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32622" }, { "reference_url": "https://github.com/advisories/GHSA-8796-gc9j-63rv", "reference_id": "GHSA-8796-gc9j-63rv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8796-gc9j-63rv" }, { "reference_url": "https://github.com/advisories/GHSA-cg57-p69r-3m7p", "reference_id": "GHSA-cg57-p69r-3m7p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cg57-p69r-3m7p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80759?format=api", "purl": "pkg:npm/matrix-react-sdk@3.21.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4zyy-8bxy-9ygp" }, { "vulnerability": "VCID-bs36-6f91-euhe" }, { "vulnerability": "VCID-nmnn-3ved-e3f8" }, { "vulnerability": "VCID-syjq-9gqf-47h9" }, { "vulnerability": "VCID-v528-sdjx-h3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.21.0" } ], "aliases": [ "CVE-2021-32622", "GHSA-8796-gc9j-63rv", "GHSA-cg57-p69r-3m7p" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v2zw-kzp5-s3fd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45041?format=api", "vulnerability_id": "VCID-v528-sdjx-h3d7", "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nmatrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00575", "scoring_system": "epss", "scoring_elements": "0.69194", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00575", "scoring_system": "epss", "scoring_elements": "0.69175", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00575", "scoring_system": "epss", "scoring_elements": "0.69199", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00575", "scoring_system": "epss", "scoring_elements": "0.6919", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609", "reference_id": "CVE-2023-30609", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609" }, { "reference_url": "https://github.com/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv83-x443-7rmw" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64960?format=api", "purl": "pkg:npm/matrix-react-sdk@3.71.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4zyy-8bxy-9ygp" }, { "vulnerability": "VCID-bs36-6f91-euhe" }, { "vulnerability": "VCID-ttnv-yue6-1bhr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.71.0" } ], "aliases": [ "CVE-2023-30609", "GHSA-xv83-x443-7rmw" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v528-sdjx-h3d7" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@0.3.0" }