-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-js-sdk | npm | >= 17.1.0-rc.1, < 19.7.0 | 19.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper validation of MSC3488 beacon events. The commit diff shows critical changes to parseBeaconContent() where they added null checks and handling for undefined values (CVE-2022-39236 specifically mentions improper beacon event handling). The Beacon class modifications in models/beacon.ts adding validity checks for 'uri' and 'timestamp' indicate previous missing validation. These functions directly process beacon event content and their pre-patch versions would allow malformed events to disrupt SDK operation as described in the advisory.
Ongoing coverage of React2Shell