CVE-2023-28427 - CVE House

Back to Database

Status published High CVE-2023-28427

Prototype pollution in matrix-js-sdk

8.2 CVSS

Vulnerability Description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28427

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →

matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values

matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

Matrix Rust SDK allows SQL injection in the EventCache implementation

matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

Affected Vendor

matrix-org

View all reports →

Affected Software

matrix-js-sdk

Vulnerable Versions:

< 24.0.0

Timeline

Official Publish: March 28th, 2023

Last Modified: February 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.