CVE-2023-41318

Description

matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo

How to fix CVE-2023-41318

To remediate CVE-2023-41318, upgrade the affected package to a fixed version below.

• Go/github.com/turt2live/matrix-media-repo—upgrade to 1.3.0 or later
• —upgrade to 1.3.0 or later

Is CVE-2023-41318 being exploited?

Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.3.0
• from 0, < 1.3.0

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-41318
• PATCHgithub.com/turt2live/matrix-media-repo
• WEBdeveloper.mozilla.org/en-US/docs/Web/SVG/Element/script
• WEBgithub.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137