Prototype pollution in matrix-js-sdk

CVE-2023-28427

What is CVE-2023-28427?

The matrix-js-sdk, a Client-Server SDK for the Matrix messaging protocol, exhibits a vulnerability that allows events containing special strings to interfere with its normal operation. This disruption can manifest as the exclusion or corruption of runtime data that is critical for users, even though the SDK may appear to function normally. As the problem can significantly impact the safe processing of data, users are strongly advised to upgrade to matrix-js-sdk version 24.0.0 or later, as there are currently no viable workarounds available for this issue. Further details on the vulnerability can be found in the relevant security advisories.

References