CVE-2023-28103: High severity matrix react sdk vulnerability
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28103?
CVE-2023-28103 has been classified as a high severity vulnerability due to its potential to cause denial of service.
How does CVE-2023-28103 affect matrix-react-sdk?
CVE-2023-28103 can disrupt functionalities of matrix-react-sdk by modifying the Object.prototype, leading to critical operational issues.
What versions of matrix-react-sdk are affected by CVE-2023-28103?
CVE-2023-28103 affects versions of matrix-react-sdk up to but not including 3.69.0.
How do I fix CVE-2023-28103?
To fix CVE-2023-28103, update matrix-react-sdk to the latest version that contains the security patch.
Is there a workaround for CVE-2023-28103?
There are no specific workarounds available for CVE-2023-28103; upgrading to a safe version is recommended.