Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-react-sdk | 3.18.0 to before 3.102.0 | 3.102.0 | Patch available | CNA |
| — | matrix-react-sdk (npm) | 3.18.0 to before 3.102.0 | 3.102.0 | Patch available | GHSA-qcvh-p9jq-wp8v |
- matrix-react-sdk Vendormatrix-org Affected 3.18.0 to before 3.102.0 Fixed in 3.102.0 Patch available CNA
- matrix-react-sdk (npm) Vendor— Affected 3.18.0 to before 3.102.0 Fixed in 3.102.0 Patch available GHSA-qcvh-p9jq-wp8v
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* | — | — | Matrix-react-sdk Project |
- cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* Versions — — ·Matrix-react-sdk Project
Remediation
- Fix · CNA matrix-react-sdk (matrix-org) Fixed in 3.102.0
- Fix · GHSA-qcvh-p9jq-wp8v matrix-react-sdk (npm) Fixed in 3.102.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47824
- 2026-10-03 Alias added: GHSA-qcvh-p9jq-wp8v
- 2026-10-13 EPSS moved to the 50th–90th percentile
References
More matrix-org vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
- TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-47824 · CVE Program
- CVE-2024-47824 · NVD
- FIRST EPSS
- GHSA-qcvh-p9jq-wp8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences