Low severity · published Sep 16, 2025
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
2.7
CVSS
0.2%
EPSS
No
On KEV
Description
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-js-sdk · matrix-org
< 38.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59160
github.com
https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4
github.com
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v
More from matrix-js-sdk
7.5
CVE-2022-39250
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification