CVE-2022-36060 - CVE House
Back to Database
Status published High CVE-2022-36060

Prototype pollution in matrix-react-sdk

Vulnerability Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36060

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
Low 1.3
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low 2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low 2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium 5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium 4.9

Affected Vendor

Affected Software

matrix-react-sdk
Vulnerable Versions:
< 3.53.0

Timeline

Official Publish: March 28th, 2023
Last Modified: February 18th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.