CVE-2025-59160: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Impact matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.
Patches The issue has been patched and users should upgrade to 38.2.0.
Workarounds Avoid using MatrixClient::getJoinedRooms in favour of getRooms() and filtering upgraded rooms separately.
Other sources
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59160?
CVE-2025-59160 has been rated as a moderate severity vulnerability due to insufficient validation of room predecessor links.
How do I fix CVE-2025-59160?
To fix CVE-2025-59160, update the Matrix JavaScript SDK to version 38.2.0 or later.
What type of vulnerability is CVE-2025-59160?
CVE-2025-59160 is a validation vulnerability affecting the Matrix JavaScript SDK.
Who is affected by CVE-2025-59160?
Users of Matrix JavaScript SDK versions below 38.2.0 are affected by CVE-2025-59160.
What can a remote attacker do with CVE-2025-59160?
A remote attacker can potentially replace a tombstoned room with an unrelated room due to insufficient link validation.