Read the docs
TI-2023-12682 Aliases CVE-2023-28103GHSA-6g43-88cp-w5gv

Prototype pollution in matrix-react-sdk

Priority MEDIUM 43CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00712 53rd percentileScored 2026-11-07
Fix Fixed matrix-react-sdk (matrix-org): 3.69.0matrix-react-sdk (npm): 3.69.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-react-sdkbefore 3.69.03.69.0Patch availableCNA
—matrix-react-sdk (npm)before 3.69.03.69.0Patch availableGHSA-6g43-88cp-w5gv
  • matrix-react-sdk Vendormatrix-org Affected before 3.69.0 Fixed in 3.69.0 Patch available CNA
  • matrix-react-sdk (npm) Vendor— Affected before 3.69.0 Fixed in 3.69.0 Patch available GHSA-6g43-88cp-w5gv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:*before 3.69.0VulnerableMatrix-react-sdk Project
  • cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* Versions before 3.69.0 Vulnerable ·Matrix-react-sdk Project

Remediation

  • Fix · CNA matrix-react-sdk (matrix-org) Fixed in 3.69.0
  • Fix · GHSA-6g43-88cp-w5gv matrix-react-sdk (npm) Fixed in 3.69.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28103
  2. 2026-10-03 Alias added: GHSA-6g43-88cp-w5gv

References

Advisory 3

Other 2

  • TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
  • TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
  • TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
  • TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences