CVE-2022-36060

HIGH7.2EPSS 0.21%

matrix-react-sdk Prototype pollution vulnerability

Published: 3/28/2023Modified: 11/8/2023

Description

### Impact Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. ### Patches This is fixed in matrix-react-sdk 3.53.0 ### Workarounds There are no workarounds. Please upgrade immediately. ### References https://learn.snyk.io/lessons/prototype-pollution/javascript/ ### For more information If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:[email protected]).

Affected packages (1)

npm/matrix-react-sdkfrom 0, < 3.53.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-36060
PATCHhttps://github.com/matrix-org/matrix-react-sdk
WEBhttps://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0
WEBhttps://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr