Executive brief
matrix-js-sdk is a JavaScript library used by Matrix chat applications to manage rooms and conversations. An attacker can exploit insufficient validation of room predecessor links to trick an application into replacing a closed room with an attacker-controlled room, potentially causing users to join the wrong conversation or lose chat history continuity.
Technical details
The vulnerability exists in the MatrixClient::getJoinedRooms method due to insufficient validation of room predecessor links when determining if a room has been upgraded. An attacker can supply a crafted room predecessor link to replace a tombstoned (closed) room with an unrelated attacker-supplied room. The attack is network-reachable and requires no authentication or user interaction. Successful exploitation allows a remote attacker to manipulate room upgrade logic, potentially redirecting users to malicious rooms. The issue is patched in version 38.2.0; users can also work around it by using getRooms() and manually filtering upgraded rooms instead of relying on getJoinedRooms.
Affected products
- Matrix.org matrix-js-sdk before 38.2.0
Timeline
- 2025-09-16: disclosed
- 2025-09-16: patched: version 38.2.0 released