Quick answers
- Is CVE-2025-59160 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-59160 being exploited in the wild.
- How severe is CVE-2025-59160?
- Medium severity, with a CVSS score of 4, published 16 September 2025.
- Which products and versions are affected?
- matrix-js-sdk (npm) SEMVER:introduced=0,fixed=38.2.0.
- Is there a fix for CVE-2025-59160?
- Yes. matrix-js-sdk (npm): upgrade to 38.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-59160 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-59160?
- Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- matrix-js-sdk (npm): upgrade to 38.2.0 or later
npm install matrix-js-sdk@38.2.0
Technical details
The vulnerability exists in the MatrixClient::getJoinedRooms method due to insufficient validation of room predecessor links when determining if a room has been upgraded. An attacker can supply a crafted room predecessor link to replace a tombstoned (closed) room with an unrelated attacker-supplied room. The attack is network-reachable and requires no authentication or user interaction. Successful exploitation allows a remote attacker to manipulate room upgrade logic, potentially redirecting users to malicious rooms. The issue is patched in version 38.2.0; users can also work around it by using getRooms() and manually filtering upgraded rooms instead of relying on getJoinedRooms.
Affected products
- Matrix.org matrix-js-sdk before 38.2.0
Identifiers
- CVE-2025-59160
- GHSA-mp7c-m3rh-r56v
Timeline
- 2025-09-16: disclosed
- 2025-09-16: patched: version 38.2.0 released