high 8.2

CVE-2023-28427 json

Prototype pollution in matrix-js-sdk

published 2023-03-28 3 y ago modified 2026-09-10 1 mo ago also GHSA-mwq8-fjpf-c2gr , EUVD-2023-1061

cvss: 8.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 2 distros 7

npm matrix-js-sdk 24.0.0
matrix javascript_sdk 24.0.0

debian red hat suse opensuse almalinux rocky linux alpine

thunderbird Debian 14, Debian 13, Debian 12 1:102.9.1-1

debian advisories DEBIAN-CVE-2023-28427

thunderbird RHEL 8 102.10.0-2.el8_7
thunderbird RHEL 9 102.10.0-2.el9_1
thunderbird RHEL 7 102.10.0-2.el7_9
thunderbird RHEL 8.1 E4S 102.10.0-2.el8_1
thunderbird RHEL 9.0 EUS 102.10.0-2.el9_0
thunderbird RHEL 8.6 EUS 102.10.0-2.el8_6
thunderbird RHEL 8.4 EUS 102.10.0-2.el8_4
thunderbird RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 102.10.0-2.el8_2

red hat advisories RHSA-2023:1802 RHSA-2023:1803 RHSA-2023:1809 RHSA-2023:1810 RHSA-2023:1811 RHSA-2023:1804

MozillaThunderbird SLE Workstation Extension 15 SP4, SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 102.9.1-150200.8.110.2

suse advisories SUSE-SU-2023:1736-1

element-web openSUSE Tumbleweed 1.11.26-1.1
MozillaThunderbird openSUSE Tumbleweed 102.10.0-1.1

opensuse advisories openSUSE-SU-2024:12823-1 openSUSE-SU-2024:12852-1

thunderbird AlmaLinux 8 102.10.0-2.el8_7.alma
thunderbird AlmaLinux 9 102.10.0-2.el9_1.alma

almalinux advisories ALSA-2023:1802 ALSA-2023:1809

thunderbird Rocky Linux 9 102.10.0-2.el9_1
thunderbird Rocky Linux 8 102.10.0-2.el8_7

rocky linux advisories RLSA-2023:1809 RLSA-2023:1802

riot-web Alpine 3.17 1.11.26-r0
element-web Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.11.26-r0

alpine advisories ALPINE-CVE-2023-28427

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28427 updated 2026-11-09 cvss 7.5

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack

Red Hat Enterprise Linux 6 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) thunderbird 102.10.0-2.el8_7
fixed: vendor fix RHSA-2023:1802
Red Hat Enterprise Linux AppStream (v. 9) thunderbird 102.10.0-2.el9_1
fixed: vendor fix RHSA-2023:1809
Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird 102.10.0-2.el8_2
fixed: vendor fix RHSA-2023:1805
Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird 102.10.0-2.el8_1
fixed: vendor fix RHSA-2023:1803
Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird 102.10.0-2.el8_2
fixed: vendor fix RHSA-2023:1805
Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird 102.10.0-2.el8_4
fixed: vendor fix RHSA-2023:1804
Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird 102.10.0-2.el8_6
fixed: vendor fix RHSA-2023:1811

show 3 more

Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird 102.10.0-2.el9_0
fixed: vendor fix RHSA-2023:1810
Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird 102.10.0-2.el8_2
fixed: vendor fix RHSA-2023:1805
Red Hat Enterprise Linux Client (v. 7) thunderbird 102.10.0-2.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) thunderbird 102.10.0-2.el7_9 Red Hat Enterprise Linux Workstation (v. 7) thunderbird 102.10.0-2.el7_9
fixed: vendor fix RHSA-2023:1806

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 20 mo ago (2025-02-18)

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
GitHub	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	matrix-js-sdk	<24.0.0	24.0.0

Affected products

matrix-org matrix-js-sdk

Classification

Weakness

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

github.com /matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr
web, vendor-advisory
matrix.org /blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0
web, vendor-advisory
debian.org /security/2023/dsa-5392
web
lists.debian.org /debian-lts-announce/2023/04/msg00027.html
web
security.gentoo.org /glsa/202305-36
web
github.com /matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32
web
nvd.nist.gov /vuln/detail/CVE-2023-28427
advisory
github.com /matrix-org/matrix-js-sdk
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary