요약
- CVE-2025-59160은(는) matrix-js-sdk에 영향을 주는 낮음 (CVSS 2.7) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.6%보다 높음.
- 조치: 38.2.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| matrix-js-sdk npm | < 38.2.0
| 38.2.0
|
Description
Impact
matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.
Patches
The issue has been patched and users should upgrade to 38.2.0.
Workarounds
Avoid using MatrixClient::getJoinedRooms in favour of getRooms() and filtering upgraded rooms separately.
NVD description
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free