CVE-2025-59160
Gravedad CVSS v4.0:
BAJA
Tipo:
CWE-345
Verificación insuficiente de autenticidad de los datos
Fecha de publicación:
16/09/2025
Última modificación:
17/09/2025
Descripción
*** Pendiente de traducción *** Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.