-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-react-sdk | npm | < 3.105.1 | 3.105.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the client trusting server-provided account data to control security-sensitive settings. Key functions would be those handling: 1) Retrieval of room account data (MatrixClient.js) where server manipulation occurs, and 2) The URL preview enablement check (UrlPreviewManager.js) that uses this untrusted data. These locations align with the described attack vector where server-controlled data overrides client security settings for URL previews in encrypted rooms.
Ongoing coverage of React2Shell