Matrix vulnerabilities
We track 12 vulnerabilities in Matrix products across 5 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on September 27, 2023.
Latest Matrix vulnerabilities
- 9.0 Critical severity
matrix-hookshot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an at
- 9.8 Critical severity
matrix-appservice-irc is a Node.js IRC bridge for Matrix.
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run
- 8.2 High severity
matrix-js-sdk: Improperly Controlled Modification of Object Prototype Attributes
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the c
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication su
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shiel
- 7.5 High severity
matrix-android-sdk2: Improper Authentication
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Addit
- 8.8 High severity
matrix-appservice-irc: Improper Privilege Management
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves per
- 8.8 High severity
gomatrixserverlib: Incorrect Authorization
gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_le
- 8.8 High severity
matrix-appservice-irc: Improper Neutralization of Special Elements in Output Used by a Downstream Component
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matr