User content sandbox can be confused into opening arbitrary documents
Priority LOW 22CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.
Why it matters now
EPSS 0.00922 60th percentileScored 2026-11-07
Fix Fixed matrix-react-sdk (matrix-org): 3.15.0matrix-react-sdk (npm): 3.15.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-react-sdk | before 3.15.0 | 3.15.0 | Patch available | CNA |
| — | matrix-react-sdk (npm) | before 3.15.0 | 3.15.0 | Patch available | GHSA-52mq-6jcv-j79x |
- matrix-react-sdk Vendormatrix-org Affected before 3.15.0 Fixed in 3.15.0 Patch available CNA
- matrix-react-sdk (npm) Vendor— Affected before 3.15.0 Fixed in 3.15.0 Patch available GHSA-52mq-6jcv-j79x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* | before 3.15.0 | Vulnerable | Matrix-react-sdk Project |
- cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* Versions before 3.15.0 Vulnerable ·Matrix-react-sdk Project
Remediation
- Fix · CNA matrix-react-sdk (matrix-org) Fixed in 3.15.0
- Fix · GHSA-52mq-6jcv-j79x matrix-react-sdk (npm) Fixed in 3.15.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21320
- 2026-10-03 Alias added: GHSA-52mq-6jcv-j79x
References
Patch 2
More matrix-org vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
- TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-21320 · CVE Program
- CVE-2021-21320 · NVD
- FIRST EPSS
- GHSA-52mq-6jcv-j79x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences