# CVE-2024-42347: Matrix SDK for React URL preview bypass in encrypted rooms

Source: https://junglewise.ai/threats/cve-2024-42347-matrix-sdk-for-react-url-preview-bypass-in-encrypted-rooms  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-42347 · Severity: low · CVSS 3.1 · Published 2024-08-06

Matrix SDK for React is a client library for the Matrix communication protocol. A malicious homeserver can manipulate a user's settings to force URL previews to be enabled in encrypted rooms, causing encrypted message URLs to be exposed to the server in plain text. This defeats the encryption protection users expect and leaks metadata about their communications.

Technologies: [matrix-react-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-react-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-42347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-42347 being exploited in the wild.

**How severe is CVE-2024-42347?** Low severity, with a CVSS score of 3.1, published 6 August 2024.

**Which products and versions are affected?** matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.105.1.

**Is there a fix for CVE-2024-42347?** Yes. matrix-react-sdk (npm): upgrade to 3.105.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-42347 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-42347?** Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-react-sdk (npm): upgrade to 3.105.1 or later

  ```sh
  npm install matrix-react-sdk@3.105.1
  ```


## Technical details

The vulnerability exists in how matrix-react-sdk handles the URL preview setting for rooms. A malicious or compromised homeserver can modify a user's account data to enable URL previews in end-to-end encrypted rooms without the user's consent or awareness. When URL previews are enabled, any URLs contained in encrypted messages are sent to the homeserver to generate previews, leaking metadata that should remain protected by encryption. The attack requires a malicious or compromised homeserver (high privilege), but no user interaction. The issue was patched in version 3.105.1 by restricting the homeserver's ability to control this security-critical setting.

## Affected products

- The Matrix.org Foundation matrix-react-sdk <3.105.1

## Identifiers

- CVE-2024-42347
- GHSA-f83w-wqhc-cfp4

## Timeline

- 2024-08-06: disclosed: CVE-2024-42347 published
- 2024-08-06: patched: Fix released in version 3.105.1

## References

- [https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4](https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4)

## Related threats

- [Matrix React SDK information disclosure on room invitation](https://junglewise.ai/threats/cve-2024-47824-matrix-react-sdk-information-disclosure-on-room-invitation)
- [matrix-react-sdk XSS in Export Chat feature](https://junglewise.ai/threats/cve-2023-37259-matrix-react-sdk-xss-in-export-chat-feature)
- [Matrix React SDK HTML injection in search results](https://junglewise.ai/threats/cve-2023-30609-matrix-react-sdk-html-injection-in-search-results)
- [Matrix matrix-react-sdk prototype pollution](https://junglewise.ai/threats/cve-2023-28103-matrix-matrix-react-sdk-prototype-pollution)
- [Matrix.org matrix-react-sdk prototype pollution in event processing](https://junglewise.ai/threats/cve-2022-36060-matrix-org-matrix-react-sdk-prototype-pollution-in-event)