Read the docs
TI-2023-12971 Aliases CVE-2023-28427GHSA-mwq8-fjpf-c2gr

Prototype pollution in matrix-js-sdk

Priority MEDIUM 44CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 12 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01185 67th percentileScored 2026-11-07
Fix Partial matrix-js-sdk (matrix-org): 24.0.0matrix-js-sdk (npm): 24.0.0Red Hat: 8 advisoriesRed Hat: 12 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-js-sdkbefore 24.0.024.0.0Patch availableCNA
—matrix-js-sdk (npm)before 24.0.024.0.0Patch availableGHSA-mwq8-fjpf-c2gr
  • matrix-js-sdk Vendormatrix-org Affected before 24.0.0 Fixed in 24.0.0 Patch available CNA
  • matrix-js-sdk (npm) Vendor— Affected before 24.0.0 Fixed in 24.0.0 Patch available GHSA-mwq8-fjpf-c2gr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*before 24.0.0Vulnerablematrix-org
  • cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 24.0.0 Vulnerable ·matrix-org

Remediation

  • Fix · CNA matrix-js-sdk (matrix-org) Fixed in 24.0.0
  • Fix · GHSA-mwq8-fjpf-c2gr matrix-js-sdk (npm) Fixed in 24.0.0 Advisory →

Red Hat 8 advisories

  • RHSA-2023:1806 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-102.10.0-2.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.10.0-2.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.10.0-2.el7_9
  • RHSA-2023:1810 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird-102.10.0-2.el9_0
  • RHSA-2023:1811 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird-102.10.0-2.el8_6
Show 5 more Red Hat advisories
  • RHSA-2023:1809 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.10.0-2.el9_1
  • RHSA-2023:1804 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.10.0-2.el8_4
  • RHSA-2023:1805 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-102.10.0-2.el8_2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird-102.10.0-2.el8_2
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird-102.10.0-2.el8_2
  • RHSA-2023:1802 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.10.0-2.el8_7
  • RHSA-2023:1803 Released 2023-04-17 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.10.0-2.el8_1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1802
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:1809
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:1805
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:1803
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:1805
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1804
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1811
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:1810
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:1805
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2023:1806
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:1806
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:1806

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28427
  2. 2026-10-03 Alias added: GHSA-mwq8-fjpf-c2gr

References

Advisory 3

Other 5

  • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
  • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
  • TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
  • TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
  • TI-2021-17748 A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix… CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences