CVE-2022-36060
matrix-react-sdk Prototype pollution vulnerability
Description
### Impact Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. ### Patches This is fixed in matrix-react-sdk 3.53.0 ### Workarounds There are no workarounds. Please upgrade immediately. ### References https://learn.snyk.io/lessons/prototype-pollution/javascript/ ### For more information If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
How to fix CVE-2022-36060
To remediate CVE-2022-36060, upgrade the affected package to a fixed version below.
- —upgrade to 3.53.0 or later
Is CVE-2022-36060 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 3.53.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |