TI-2023-13897 Aliases CVE-2023-29529 GHSA-6g67-q39g-r79q

matrix-js-sdk vulnerable to invisible eavesdropping in group calls

LOW 25CWE-862Published 2023-04-14 · Updated 2025-02-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00543 45th percentileScored 2026-11-07

Fix Fixed matrix-js-sdk (matrix-org): 24.1.0matrix-js-sdk (npm): 24.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	matrix-js-sdk	before 24.1.0	24.1.0	Patch available	CNA
—	matrix-js-sdk (npm)	before 24.1.0	24.1.0	Patch available	GHSA-6g67-q39g-r79q

matrix-js-sdk Vendormatrix-org Affected before 24.1.0 Fixed in 24.1.0 Patch available CNA
matrix-js-sdk (npm) Vendor— Affected before 24.1.0 Fixed in 24.1.0 Patch available GHSA-6g67-q39g-r79q

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:javascript_sdk::::::node.js::*	before 24.1.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 24.1.0 Vulnerable ·matrix-org

Remediation

Fix · CNA matrix-js-sdk (matrix-org) Fixed in 24.1.0
Fix · GHSA-6g67-q39g-r79q matrix-js-sdk (npm) Fixed in 24.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-29529
2026-10-03 Alias added: GHSA-6g67-q39g-r79q

References

Patch 1

https://github.com/matrix-org/matrix-spec-proposals/pull/3401

Advisory 2

Other 2

TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences