High severity · published May 17, 2021
CVE-2021-32622
File upload local preview can run embedded scripts after user interaction
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-react-sdk · matrix-org
< 3.21.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32622
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32622
Patch
https://github.com/matrix-org/matrix-react-sdk/pull/5981
Patch
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
More from matrix-react-sdk
8.7
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
8.2
CVE-2023-28103
Prototype pollution in matrix-react-sdk
6.5
CVE-2024-42347
URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
5.4
CVE-2023-37259
Cross site scripting in Export Chat feature
5.3
CVE-2022-36060
Prototype pollution in matrix-react-sdk