File upload local preview can run embedded scripts after user interaction
Priority LOW 34CWE-74Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Why it matters now
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed matrix-react-sdk (matrix-org): 3.21.0matrix-react-sdk (npm): 3.21.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-react-sdk | before 3.21.0 | 3.21.0 | Patch available | CNA |
| — | matrix-react-sdk (npm) | before 3.21.0 | 3.21.0 | Patch available | GHSA-cg57-p69r-3m7p |
- matrix-react-sdk Vendormatrix-org Affected before 3.21.0 Fixed in 3.21.0 Patch available CNA
- matrix-react-sdk (npm) Vendor— Affected before 3.21.0 Fixed in 3.21.0 Patch available GHSA-cg57-p69r-3m7p
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* | before 3.21.0 | Vulnerable | Matrix-react-sdk Project |
- cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* Versions before 3.21.0 Vulnerable ·Matrix-react-sdk Project
Remediation
- Fix · CNA matrix-react-sdk (matrix-org) Fixed in 3.21.0
- Fix · GHSA-cg57-p69r-3m7p matrix-react-sdk (npm) Fixed in 3.21.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32622
- 2026-10-03 Alias added: GHSA-cg57-p69r-3m7p
References
More matrix-org vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
- TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-32622 · CVE Program
- CVE-2021-32622 · NVD
- FIRST EPSS
- GHSA-cg57-p69r-3m7p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences