matrix-react-sdk@3.70.0-rc.1 vulnerabilities

matrix-react-sdk is a SDK for matrix.org using React

Affected versions of this package are vulnerable to Information Exposure via the sendSharedHistoryKeys method. An attacker can potentially steal message keys for a room by injecting a malicious device controlled by the homeserver.

Upgrade matrix-react-sdk to version 3.102.0 or higher.

matrix-react-sdk is a SDK for matrix.org using React

Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via a malicious homeserver, allowing an attacker to change the user's account data and cause the client to enable URL previews in end-to-end encrypted rooms. Exploiting this vulnerability causes any URLs in encrypted messages to be sent to the server.

Upgrade matrix-react-sdk to version 3.105.1 or higher.

matrix-react-sdk is a SDK for matrix.org using React

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Export Chat feature, which includes certain attacker-controlled elements in the generated document without sufficient escaping.

Note: An attacker can only inject code run from the null origin, restricting the impact.

Upgrade matrix-react-sdk to version 3.76.0 or higher.

matrix-react-sdk is a SDK for matrix.org using React

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') such that plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.

Note: No cross-site scripting attack is possible due to the hardcoded content security policy.

Upgrade matrix-react-sdk to version 3.71.0 or higher.