CVE-2022-36060 - Prototype pollution in matrix-react-sdk

Back Back to CVE browser

HIGH

Prototype pollution in matrix-react-sdk

Published Mar 28, 2023

8.2

HIGH

CVSS 3.1

EPSS 0.91%

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Vendor Matrix-Org Product Matrix-React-Sdk Default
n/a
- Version
  < 3.53.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Matrix-Org

Matrix-React-Sdk

n/a

Version	Status	Constraints
< 3.53.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	matrix-react-sdk	0	3.53.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1321

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0837
Advisory
https://github.com/advisories/GHSA-2x9c-qwgf-94xr
Advisory
https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-36060

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0837		Advisory
https://github.com/advisories/GHSA-2x9c-qwgf-94xr		Advisory
https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-36060