Vulnerability advisory
GHSA-mp7c-m3rh-r56v
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Also known as CVE-2025-59160
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 38.2.0 | 38.2.0Advisories → |
Description
Impact
matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.
Patches
The issue has been patched and users should upgrade to 38.2.0.
Workarounds
Avoid using MatrixClient::getJoinedRooms in favour of getRooms() and filtering upgraded rooms separately.
References
- Webgithub.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2025-59160 ↗
- Webgithub.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4 ↗
- Packagegithub.com/matrix-org/matrix-js-sdk ↗
- Webgithub.com/matrix-org/matrix-js-sdk/releases/tag/v38.2.0 ↗
- Webwww.npmjs.com/package/matrix-js-sdk/v/38.2.0 ↗