matrix-react-sdk Prototype pollution vulnerability

TRUNG BÌNH 5.3CVE-2022-36060 · GHSA-2x9c-qwgf-94xr · Công bố 28/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-36060 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng react sdk (matrix), matrix-react-sdk.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.91%, cao hơn 59.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.53.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
react sdk matrix	`< 3.53.0`	`3.53.0`
matrix-react-sdk npm	`< 3.53.0`	`3.53.0`

Mô tả

Impact

Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.

Patches

This is fixed in matrix-react-sdk 3.53.0

Workarounds

There are no workarounds. Please upgrade immediately.

References

https://learn.snyk.io/lessons/prototype-pollution/javascript/

For more information

If you have any questions or comments about this advisory please email us at security at matrix.org.

Mô tả của NVD

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.