matrix-react-sdk Prototype pollution vulnerability

中 5.3CVE-2022-36060 · GHSA-2x9c-qwgf-94xr · 28/03/2023 公開 · 17/06/2026 更新

要点

CVE-2022-36060 は react sdk (matrix), matrix-react-sdk に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.91%（全脆弱性の 59.9% より高い）。
対処：3.53.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
react sdk matrix	`< 3.53.0`	`3.53.0`
matrix-react-sdk npm	`< 3.53.0`	`3.53.0`

概要

Impact

Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.

Patches

This is fixed in matrix-react-sdk 3.53.0

Workarounds

There are no workarounds. Please upgrade immediately.

References

https://learn.snyk.io/lessons/prototype-pollution/javascript/

For more information

If you have any questions or comments about this advisory please email us at security at matrix.org.

NVD の説明

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.