Low severity · published Sep 16, 2025
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
2.7
CVSS
0.2%
EPSS
No
On KEV
Description
Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-js-sdk · matrix-org
< 38.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59160
github.com
https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4
github.com
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v
More from matrix-js-sdk
8.7
CVE-2024-47080
matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver
7.5
CVE-2022-39250
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
5.3
CVE-2024-50336
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
5.3
CVE-2024-42369
A room with itself as a its predecessor will freeze matrix-js-sdk