-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisPrototype pollution vulnerabilities typically occur in functions that: 1) Process untrusted JSON input 2) Use recursive object merging 3) Assign properties using user-controlled keys. The advisory specifically mentions event processing impacts, pointing to functions handling event content parsing (EventUtils) and sync processing (SyncApi). The deepCopy utility is a common pattern vulnerable to prototype pollution when not using safe merging. The high confidence for utils.deepCopy and EventUtils.parseEventContent comes from their direct role in processing event data, while SyncApi._processRoomEvents gets medium confidence due to its position in the sync workflow mentioned in workarounds.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-js-sdk | npm | < 19.4.0 | 19.4.0 |