Matrix-org vulnerabilities
We track 19 vulnerabilities in Matrix-org products across 10 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on December 9, 2025.
Latest Matrix-org vulnerabilities
- 7.5 High severity
matrix-rust-sdk: Improper Handling of Exceptional Conditions
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service conditi
- 9.1 Critical severity
mjolnir: Lack of Administrator Control over Security
Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled.
- 8.7 High severity
matrix-react-sdk: Exposure of Sensitive Information to an Unauthorized Actor
matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a
- 8.7 High severity
matrix-js-sdk: Exposure of Sensitive Information to an Unauthorized Actor
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introd
- 9.0 Critical severity
matrix-hookshot: Improper Neutralization of Special Elements in Output Used by a Downstream Component
matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an at
- 9.8 Critical severity
matrix-appservice-irc is a Node.js IRC bridge for Matrix.
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run
- 8.2 High severity
matrix-js-sdk: Improperly Controlled Modification of Object Prototype Attributes
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the c
- 8.2 High severity
matrix-react-sdk: Improperly Controlled Modification of Object Prototype Attributes
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionali
- 7.5 High severity
matrix-rust-sdk: Improper Authentication
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication su
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shiel
- 7.5 High severity
matrix-android-sdk2: Improper Authentication
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Addit
- 8.8 High severity
matrix-appservice-irc: Improper Privilege Management
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves per
- 7.5 High severity
synapse: Improper Handling of Exceptional Conditions
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when det
- 8.8 High severity
gomatrixserverlib: Incorrect Authorization
gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_le
- 8.8 High severity
matrix-appservice-irc: Improper Neutralization of Special Elements in Output Used by a Downstream Component
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matr