Search for packages
Package details: pkg:npm/matrix-js-sdk@34.9.0
purl pkg:npm/matrix-js-sdk@34.9.0
Next non-vulnerable version 34.11.1
Latest non-vulnerable version 34.11.1
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-gutu-2p41-h7hg
Aliases:
CVE-2024-50336
GHSA-xvg8-m4x3-w6xr
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal ### Summary matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. ### Details The Matrix specification demands homeservers to [perform validation](https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5) of the `server-name` and `media-id` components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent *client-side* path traversal. matrix-js-sdk fails to perform this validation. ### Patches Fixed in matrix-js-sdk 34.11.1. ### Workarounds None. ### References - https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 - https://blog.doyensec.com/2024/07/02/cspt2csrf.html
34.11.1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-20T17:11:58.500671+00:00 GitLab Importer Affected by VCID-gutu-2p41-h7hg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/matrix-js-sdk/CVE-2024-50336.yml 36.1.3
2025-06-03T23:47:43.924331+00:00 GitLab Importer Affected by VCID-gutu-2p41-h7hg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/matrix-js-sdk/CVE-2024-50336.yml 36.1.0
2025-06-02T23:46:20.590102+00:00 GitLab Importer Affected by VCID-gutu-2p41-h7hg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/matrix-js-sdk/CVE-2024-50336.yml 36.1.2
2025-04-03T22:32:35.604711+00:00 GitLab Importer Affected by VCID-gutu-2p41-h7hg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/matrix-js-sdk/CVE-2024-50336.yml 36.0.0
2025-02-18T04:12:55.483773+00:00 GitLab Importer Affected by VCID-gutu-2p41-h7hg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/matrix-js-sdk/CVE-2024-50336.yml 35.1.0