CVE-2025-59160
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| matrix | matrix_js_sdk | 38.1.0 |
| matrix | matrix_js_sdk | 38.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the matrix-js-sdk (before version 38.2.0) involves insufficient validation of room predecessor links in the MatrixClient::getJoinedRooms function. It allows a remote attacker to attempt to replace a tombstoned (closed or deprecated) room with an unrelated attacker-controlled room by exploiting improper handling of room upgrade relationships. Essentially, the SDK does not properly verify that a room replacement is mutually acknowledged, which can lead to incorrect room visibility and potential confusion or manipulation in the client interface. [2, 1]
How can this vulnerability impact me? :
This vulnerability can impact users by allowing an attacker to replace a tombstoned room with an unrelated, attacker-supplied room. This could cause confusion or misrepresentation of room histories and visibility within the client, potentially misleading users about the state or content of rooms they have joined. While the severity is rated as low, it may affect the integrity of room upgrade relationships and user experience. [2, 1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to insufficient validation of room predecessor links in the matrix-js-sdk, specifically in the MatrixClient::getJoinedRooms function. Detection would involve inspecting the usage of this function in your client applications and checking if they are running a vulnerable version of matrix-js-sdk (before 38.2.0). There are no specific network detection commands provided. However, you can check the installed version of matrix-js-sdk in your project by running commands like `npm list matrix-js-sdk` or `yarn list matrix-js-sdk` to verify if the version is older than 38.2.0. Additionally, reviewing your codebase for usage of `getJoinedRooms` versus `getRooms()` with filtering can help identify potential exposure. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade the matrix-js-sdk package to version 38.2.0 or later, where the issue has been patched. As a workaround, avoid using the vulnerable MatrixClient::getJoinedRooms method and instead use getRooms() combined with separate filtering of upgraded rooms. These steps will prevent attackers from exploiting the insufficient validation of room predecessor links. [2]