N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59160

CVE-2025-59160: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Impact

matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room.

Patches

The issue has been patched and users should upgrade to 38.2.0.

Workarounds

Avoid using MatrixClient::getJoinedRooms in favour of getRooms() and filtering upgraded rooms separately.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59160

CVE-2025-59160:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
matrix-js-sdk	npm	< 38.2.0	38.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insufficient validation of room upgrade chains within the matrix-js-sdk. The advisory points to MatrixClient::getJoinedRooms, but the provided patch from the official repository modifies the MatrixClient.getVisibleRooms function. It's highly probable that getJoinedRooms is either an alias for, or directly utilizes, getVisibleRooms, making the latter the core of the vulnerability.

The analysis of the commit 43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4 reveals the exact flaw. The original code in getVisibleRooms would add any room mentioned as a predecessor to a replacedRooms set. It then filtered out any room from the main list that was in this set and had a tombstone event. The critical missing step was to verify that the tombstone event of the old room actually pointed to the new room that was claiming to be the successor. This lack of reciprocal validation is the root cause.

An attacker could exploit this by creating a new room and setting its predecessor state to point to a victim's room. If the victim's room was later tombstoned for any reason, the flawed logic in getVisibleRooms would incorrectly hide the victim's room and effectively replace it with the attacker's room in the user's room list.

The patch rectifies this by replacing the flawed logic with a call to this.findPredecessorRooms and removing the identified predecessors from the set of visible rooms. This new logic, presumably within findPredecessorRooms, correctly validates the entire upgrade chain, ensuring that a room is only considered replaced if there is a valid and verified link from the old room to the new one. The added test case in the patch confirms this by asserting that a room is not hidden when another room claims to replace it without a corresponding tombstone from the original room.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-59160: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Impact

Patches

Workarounds

CVE-2025-59160:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2025-59160: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Impact

Patches

Workarounds

Basic Information

Basic Information

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI