matrix-org matrix-js-sdk

• CVE-2025-59160 Low 2.7 matrix-js-sdk has insufficient validation when considering a room to be upgraded by another 0.2%
• CVE-2024-50336 Medium 5.3 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal 0.8%
• CVE-2024-47080 High 8.7 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver 0.7%
• CVE-2024-42369 Medium 4.1 A room with itself as a its predecessor will freeze matrix-js-sdk 0.5%
• CVE-2023-29529 Medium 5.0 matrix-js-sdk vulnerable to invisible eavesdropping in group calls 0.5%
• CVE-2023-28427 High 8.2 Prototype pollution in matrix-js-sdk 1.2%
• CVE-2022-36059 High 8.2 Prototype pollution in matrix-js-sdk 0.9%
• CVE-2022-39250 High 8.6 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification 1.2%
• CVE-2022-39236 Medium 4.3 Matrix Javascript SDK improper beacon events can cause availability issues 1.4%
• CVE-2022-39251 High 8.6 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion 1.2%
• CVE-2022-39249 High 7.5 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions 1.3%