Insufficient Validation Vulnerability in Matrix JavaScript SDK by Matrix
CVE-2025-59160

2.7LOW

Key Information:

Vendor

Matrix-org

Status
Matrix-js-sdk
Vendor
CVE Published:
16 September 2025

What is CVE-2025-59160?

The Matrix JavaScript SDK is susceptible to a security flaw that allows a remote attacker to manipulate room links within the client. Specifically, versions prior to 38.2.0 fail to adequately validate predecessor links in the MatrixClient::getJoinedRooms function. This oversight enables an attacker to attempt to replace a previously tombstoned room with an unrelated room that they control. To mitigate this vulnerability, users are encouraged to update to version 38.2.0 or later. As an interim solution, using the getRooms() function and manually filtering the upgraded rooms is recommended.

Affected Version(s)

matrix-js-sdk < 38.2.0

References

https://github.com/matrix-org/matrix-js-sdk/security/advi...
x_refsource_CONFIRM
https://github.com/matrix-org/matrix-js-sdk/commit/43c72d...
x_refsource_MISC

CVSS V4

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59160 : Insufficient Validation Vulnerability in Matrix JavaScript SDK by Matrix