CVE-2024-50336: matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

November 12, 2024 (updated November 4, 2025)

matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client’s homeserver.

References

github.com/advisories/GHSA-xvg8-m4x3-w6xr
github.com/matrix-org/matrix-js-sdk
github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr
lists.debian.org/debian-lts-announce/2025/01/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2024-50336
spec.matrix.org/v1.12/client-server-api/

Code Behaviors & Features

Detect and mitigate CVE-2024-50336 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →