File Upload Local Preview Script Execution in matrix-react-sdk
Summary
GHSA-8796-gc9j-63rv: File upload local preview can run embedded scripts after user interaction. Affects matrix-react-sdk versions < 3.21.0. Fixed in 3.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-react-sdk is an npm package that provides a React-based SDK for building Matrix clients. It allows developers to create applications that interact with the Matrix communication protocol. The package includes features such as file uploading, which enables users to upload files to the Matrix server. However, a vulnerability has been discovered in the local file preview functionality of matrix-react-sdk.
Vulnerability Detail
The vulnerability in matrix-react-sdk allows for the execution of embedded scripts in uploaded files during the local file preview. However, this can only occur after several user interactions to open the preview in a separate tab. It is important to note that this vulnerability only affects the local user during the file upload process and cannot be exploited remotely or by other users. The impact of this vulnerability is considered moderate, with a CVSS score of 4.2. The vulnerability is classified under CWE-74, which relates to improper neutralization of input during web page generation.
How To Fix
Latest published version: 3.114.0 as of 23 Oct 2026
npm install matrix-react-sdk@3.114.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.21.0
This is the first release that contains the fix.
npm install matrix-react-sdk@3.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to apply the fix by updating to version 3.21.0 of matrix-react-sdk.
Conclusion
In conclusion, the vulnerability in matrix-react-sdk allows for the execution of embedded scripts in uploaded files during the local file preview. However, this vulnerability can only be exploited by the local user during the file upload process and has a moderate impact. It is recommended to update to version 3.21.0 of matrix-react-sdk to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-react-sdk →
FAQ
No, this vulnerability can only be exploited by the local user during the file upload process.
The impact is considered moderate, with a CVSS score of 4.2. It allows for the execution of embedded scripts in uploaded files during the local file preview.
No, this vulnerability only affects the local user who is uploading the file.
This vulnerability is classified under CWE-74, which relates to improper neutralization of input during web page generation.
Yes, the vulnerability has been fixed in version 3.21.0 of matrix-react-sdk.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-react-sdk.
