Matrix SDK for React's URL preview setting for a room is controllable by the homeserver
Impact
A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server.
Even if the CVSS score would be 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) the maintainer classifies this as High severity issue.
Patches
This was patched in matrix-react-sdk 3.105.1.
Workarounds
Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected.
References
N/A.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | matrix-react-sdk | < 3.105.1 | 3.105.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N- Weakness (CWE)
CWE-359- Platform
- npm
- Package
matrix-react-sdk- Disclosed
- 06.08.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f83w-wqhc-cfp4 - CC BY 4.0
Vulnerability history: matrix-react-sdk
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 03.2021 10.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 3
- Low 1
Disclosures per year
- 2021: 2
- 2022: 0
- 2023: 4
- 2024: 2
- 2025: 0
- 2026: 0
-
Matrix SDK for React's URL preview setting for a room is controllable by the homeserver this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.