File upload local preview can run embedded scripts after user interaction

CAO 7.8CVE-2021-32622 · GHSA-8796-gc9j-63rv · GHSA-cg57-p69r-3m7p · Công bố 17/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-32622 là lỗ hổng mức CAO (CVSS 7.8) ảnh hưởng matrix-react-sdk (matrix-react-sdk project), matrix-react-sdk.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.37%, cao hơn 31.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.21.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
matrix-react-sdk matrix-react-sdk_project	`< 3.21.0`	`3.21.0`
matrix-react-sdk npm	`< 3.21.0`	`3.21.0`

Mô tả

Impact

When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.

Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.

Workarounds

There are no known workarounds.

Mô tả của NVD

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.