Prototype pollution in matrix-react-sdk

Vulnerability

Overview

CVE-2022-36060 is a prototype pollution vulnerability in matrix-react-sdk, a React-based SDK for building Matrix chat clients. Events containing specially crafted strings in certain key fields can trigger crashes in room or event tile rendering, temporarily disrupting the normal display of affected conversations. The underlying issue stems from improper sanitization of event data, leading to prototype pollution that corrupts the SDK's internal state [1][2].

Attack

Vector and Exploitation

An attacker capable of sending messages to a Matrix room or otherwise injecting events can include malicious payloads in event content. No special privileges beyond the ability to send normal events are required; the vulnerability is triggered when the client processes the malformed event. The attack surface is limited to clients using the vulnerable SDK, and exploitation results in only partial denial of service—the rest of the application remains functional, but specific rooms or event tiles fail to render [4].

Impact

Successful exploitation causes selective denial of service by making certain rooms or messages invisible to the user. The attacker cannot execute arbitrary code or leak sensitive data, but can persistently disrupt communication within targeted rooms until the user restarts the client or clears caches. The vulnerability is classified with a CVSS score (per NVD) reflecting a medium-severity impact, with integrity and availability affected to a limited degree [2].

Mitigation

The issue has been fixed in matrix-react-sdk version 3.53.0, released on August 31, 2022. Users are strongly advised to upgrade immediately, as no effective workarounds exist. The fix is included in the corresponding Element Web releases. Affected versions of matrix-react-sdk are those prior to 3.53.0 [3][4].