icon

We found results for “

CVE-2025-59160

Good to know:

icon
icon

Date: September 16, 2025

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.

Severity Score

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Insufficient Verification of Data Authenticity

CWE-345

Missing Authorization

CWE-862

Top Fix

icon

Upgrade Version

Upgrade to version matrix-js-sdk - 38.2.0;https://github.com/matrix-org/matrix-js-sdk.git - v38.2.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us