Prototype pollution in matrix-js-sdk

CVE-2022-36059

What is CVE-2022-36059?

The matrix-js-sdk, an SDK for the Matrix messaging protocol in JavaScript, has a vulnerability in its event processing mechanism. In versions before 19.4.0, the SDK can malfunction if specific strings are included in key locations, resulting in potential disruptions to data handling. While the SDK might appear operational, it may inadvertently exclude or corrupt critical runtime data presented to users. To safeguard data integrity, it is crucial for users to upgrade to version 19.4.0 or later. For those unable to upgrade, mitigating actions such as redacting certain events or restarting the client may alleviate some issues, but in certain situations, workarounds may be limited.

References