Vulnerability advisory
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Also known as GHSA-mp7c-m3rh-r56v
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/matrix-org/matrix-js-sdk ↗ | |
| All commits before 4a9006aea68f9d4d7fad3965e754e89b03fb286f | 4a9006aea68f9d4d7fad3965e754e89b03fb286f |
| Not specified | 43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4 |
Also listed as affected (66)
| |
Description
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59160.json ↗
- Advisorygithub.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-59160 ↗
- Fixgithub.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4 ↗