Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/364349?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/364349?format=api", "purl": "pkg:npm/matrix-react-sdk@3.20.0-rc.1", "type": "npm", "namespace": "", "name": "matrix-react-sdk", "version": "3.20.0-rc.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "3.105.1", "latest_non_vulnerable_version": "3.105.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17381?format=api", "vulnerability_id": "VCID-1g1f-1x88-tbg5", "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nmatrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00483", "scoring_system": "epss", "scoring_elements": "0.65282", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65361", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65424", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65413", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65396", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65451", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65434", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65449", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65438", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65402", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65429", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.65443", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00486", "scoring_system": "epss", "scoring_elements": "0.6537", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01152", "scoring_system": "epss", "scoring_elements": "0.78584", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-30609" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609", "reference_id": "CVE-2023-30609", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30609" }, { "reference_url": "https://github.com/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv83-x443-7rmw" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw", "reference_id": "GHSA-xv83-x443-7rmw", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T17:54:49Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57322?format=api", "purl": "pkg:npm/matrix-react-sdk@3.71.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.71.0" } ], "aliases": [ "CVE-2023-30609", "GHSA-xv83-x443-7rmw" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1g1f-1x88-tbg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16964?format=api", "vulnerability_id": "VCID-3s7z-6bqr-rqd1", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69358", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69493", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69487", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69481", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69429", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69447", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69436", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69388", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69338", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69397", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69411", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69426", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69341", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00598", "scoring_system": "epss", "scoring_elements": "0.69404", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103", "reference_id": "CVE-2023-28103", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28103" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6g43-88cp-w5gv" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv", "reference_id": "GHSA-6g43-88cp-w5gv", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T17:26:21Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56643?format=api", "purl": "pkg:npm/matrix-react-sdk@3.69.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1g1f-1x88-tbg5" }, { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.69.0" } ], "aliases": [ "CVE-2023-28103", "GHSA-6g43-88cp-w5gv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3s7z-6bqr-rqd1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12290?format=api", "vulnerability_id": "VCID-e42f-h16f-gkbf", "summary": "Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room\n### Impact\n\nmatrix-react-sdk before 3.102.0 allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite.\n\n### Patches\n\nmatrix-react-sdk 3.102.0 [disables sharing message keys on invite](https://github.com/matrix-org/matrix-react-sdk/pull/12618) by removing calls to the vulnerable functionality.\n\n### Workarounds\n\nNone.\n\n### References\n\nThe vulnerability in matrix-react-sdk is caused by calling `MatrixClient.sendSharedHistoryKeys` in matrix-js-sdk, which is inherently vulnerable to this sort of attack. This matrix-js-sdk vulnerability is tracked as CVE-2024-47080 / [GHSA-4jf8-g8wp-cx7c](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-4jf8-g8wp-cx7c). Given that this functionality is not specific to sharing message keys on *invite*, is optional, has to be explicitly called by the caller and has been independently patched in matrix-react-sdk by removing the offending calls, we believe it is proper to treat the matrix-react-sdk vulnerability as a separate one, with its own advisory and CVE.\n\nThe matrix-org/matrix-react-sdk repository has recently been archived and the project was moved to [element-hq/matrix-react-sdk](https://github.com/element-hq/matrix-react-sdk). Given that this happened *after* the first patched release, no releases of the project on [element-hq/matrix-react-sdk](https://github.com/element-hq/matrix-react-sdk) were ever vulnerable to this vulnerability.\n\nPatching pull request: https://github.com/matrix-org/matrix-react-sdk/pull/12618.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at security at [security at matrix.org](mailto:security@matrix.org).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47824", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.66969", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67068", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67054", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67034", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67053", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67039", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67006", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67036", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67051", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67031", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.67019", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00526", "scoring_system": "epss", "scoring_elements": "0.66995", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47824" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-15T16:35:51Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/pull/12618", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-15T16:35:51Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/pull/12618" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-15T16:35:51Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47824", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47824" }, { "reference_url": "https://github.com/advisories/GHSA-qcvh-p9jq-wp8v", "reference_id": "GHSA-qcvh-p9jq-wp8v", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qcvh-p9jq-wp8v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/43725?format=api", "purl": "pkg:npm/matrix-react-sdk@3.102.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-k3ft-j7d1-nkh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.102.0" } ], "aliases": [ "CVE-2024-47824", "GHSA-qcvh-p9jq-wp8v" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e42f-h16f-gkbf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15845?format=api", "vulnerability_id": "VCID-k3ft-j7d1-nkh7", "summary": "Matrix SDK for React's URL preview setting for a room is controllable by the homeserver\n### Impact\nA malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server.\n\nEven if the CVSS score would be 4.1 ([AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N&version=3.1)) the maintainer classifies this as High severity issue.\n\n### Patches\nThis was patched in matrix-react-sdk 3.105.1.\n\n### Workarounds\nDeployments that trust their homeservers, as well as closed federations of trusted servers, are not affected.\n\n### References\nN/A.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.7343", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73535", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73537", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73526", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73492", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73499", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73476", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73453", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73439", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73402", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73407", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.7349", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73448", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00766", "scoring_system": "epss", "scoring_elements": "0.73456", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-42347" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "7.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T18:48:06Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Red" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42347" }, { "reference_url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4", "reference_id": "GHSA-f83w-wqhc-cfp4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f83w-wqhc-cfp4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55117?format=api", "purl": "pkg:npm/matrix-react-sdk@3.105.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.105.1" } ], "aliases": [ "CVE-2024-42347", "GHSA-f83w-wqhc-cfp4" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "6.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k3ft-j7d1-nkh7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16954?format=api", "vulnerability_id": "VCID-ybpz-t956-k7fb", "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nmatrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62213", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62248", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62255", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62238", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62228", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62243", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62236", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00424", "scoring_system": "epss", "scoring_elements": "0.62192", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63167", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63138", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63132", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63184", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63201", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63219", "published_at": "2026-04-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36060" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060", "reference_id": "CVE-2022-36060", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36060" }, { "reference_url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2x9c-qwgf-94xr" }, { "reference_url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr", "reference_id": "GHSA-2x9c-qwgf-94xr", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-18T19:56:40Z/" } ], "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56627?format=api", "purl": "pkg:npm/matrix-react-sdk@3.53.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1g1f-1x88-tbg5" }, { "vulnerability": "VCID-3s7z-6bqr-rqd1" }, { "vulnerability": "VCID-e42f-h16f-gkbf" }, { "vulnerability": "VCID-k3ft-j7d1-nkh7" }, { "vulnerability": "VCID-kgyw-t9rt-vkfg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.53.0" } ], "aliases": [ "CVE-2022-36060", "GHSA-2x9c-qwgf-94xr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ybpz-t956-k7fb" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.20.0-rc.1" }