High severity8.2NVD Advisory· Published Mar 28, 2023· Updated Jun 17, 2026

CVE-2022-36060

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
matrix-react-sdknpm	< 3.53.0	3.53.0

Affected products

ghsa-coords
pkg:npm/matrix-react-sdk
Range: < 3.53.0
Matrix Org/Matrix React SDKcpe-rescue
Range: < 3.53.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2x9c-qwgf-94xrghsaADVISORY
github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xrnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-36060ghsaADVISORY
github.com/matrix-org/matrix-react-sdk/releases/tag/v3.53.0ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000