CVE-2021-32622: File upload local preview can run embedded scripts after user interaction
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32622?
CVE-2021-32622 has a medium severity due to the potential for script execution from uploaded files.
How do I fix CVE-2021-32622?
To fix CVE-2021-32622, upgrade Matrix-React-SDK to version 3.21.0 or later.
What causes CVE-2021-32622 vulnerability?
CVE-2021-32622 is caused by the local file preview feature that allows execution of scripts from uploaded files.
Who is affected by CVE-2021-32622?
Users of Matrix-React-SDK versions before 3.21.0 are affected by CVE-2021-32622.
What actions should be taken to mitigate CVE-2021-32622?
To mitigate CVE-2021-32622, implement file upload restrictions or upgrade to a secure version of Matrix-React-SDK.