Product by Matrix-org
Matrix-js-sdk
11 known vulnerabilities in Matrix-js-sdk (Matrix-org), 0 of them actively exploited (CISA KEV).
Key figures
11
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-39250 | Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification | 8.6 | |
| High | CVE-2022-39251 | Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion | 8.6 | |
| High | CVE-2023-28427 | Prototype pollution in matrix-js-sdk | 8.2 | |
| High | CVE-2022-39249 | Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions | 7.5 | |
| High | CVE-2022-36059 | Prototype pollution in matrix-js-sdk | 8.2 | |
| High | CVE-2024-47080 | Matrix-org Matrix-js-sdk: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| Medium | CVE-2022-39236 | Matrix Javascript SDK improper beacon events can cause availability issues | 4.3 | |
| Medium | CVE-2024-50336 | matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal | — | |
| Medium | CVE-2023-29529 | matrix-js-sdk vulnerable to invisible eavesdropping in group calls | 5.0 | |
| Medium | CVE-2024-42369 | A room with itself as a its predecessor will freeze matrix-js-sdk | 4.1 | |
| Low | CVE-2025-59160 | matrix-js-sdk has insufficient validation when considering a room to be upgraded by another | — |