CVE-2025-59160 – matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

CVE ID : CVE-2025-59160

Published : Sept. 16, 2025, 4:37 p.m. | 18 minutes ago

Description : Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…