{"answers":{"affected":"2 open source packages ship an affected version, including matrix-react-sdk. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-21320 in the wild and no public exploit code.","fix":"Upgrade matrix-react-sdk to 3.15.0 or later.","what":"CVE-2021-21320 is a low-severity vulnerability in matrix-org matrix-react-sdk, published on 2 Mar 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2021-21320 and fix it if it is affected.\n\nWhat it is: CVE-2021-21320 is a low-severity vulnerability in matrix-org matrix-react-sdk, published on 2 Mar 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2021-21320 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- matrix-react-sdk (npm): affected all versions; fixed in 3.15.0\n- matrix-react-sdk (npm): affected all versions; fixed in 3.15.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-21320/ (Markdown: https://insights.sbomify.com/CVE-2021-21320/index.md)","id":"CVE-2021-21320","markdown":"https://insights.sbomify.com/CVE-2021-21320/index.md","name":"CVE-2021-21320","record":{"aliases":["GHSA-52mq-6jcv-j79x"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["other"],"network_reachable":"yes","non_default_config":false,"product_category":"Matrix React SDK","requires_auth":"low_privilege","summary":"Attackers can trick users into opening unexpected documents via sandbox confusion, though sensitive data remains protected.","user_interaction":"required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"matrix-react-sdk","vendor":"matrix-react-sdk_project"}],"cvss":{"score":2.6,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"User content sandbox can be confused into opening arbitrary documents","id":"CVE-2021-21320","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"other","year":"2021"},"n_packages":2,"n_references":4,"next":{"headline":"Prefix escape","id":"CVE-2021-21321"},"packages":[{"ecosystem":"npm","fixed":["3.15.0"],"introduced":["0"],"last_affected":[],"package":"matrix-react-sdk","purl":null,"source":"GHSA-52mq-6jcv-j79x"},{"ecosystem":"npm","fixed":["3.15.0"],"introduced":["0"],"last_affected":[],"package":"matrix-react-sdk","purl":"pkg:npm/matrix-react-sdk","source":"GHSA-52mq-6jcv-j79x"}],"prev":{"headline":"Several stored XSS","id":"CVE-2021-21319"},"products":["matrix-react-sdk"],"published":"2021-03-02","related":[{"cvss_score":8.2,"headline":"Prototype pollution in matrix-react-sdk","id":"CVE-2023-28103","kev_date_added":null,"published":"2023-03-28"},{"cvss_score":6.1,"headline":"Cross site scripting in Export Chat feature","id":"CVE-2023-37259","kev_date_added":null,"published":"2023-07-18"},{"cvss_score":5.4,"headline":"matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting","id":"CVE-2023-30609","kev_date_added":null,"published":"2023-04-25"},{"cvss_score":4.2,"headline":"File upload local preview can run embedded scripts after user interaction","id":"CVE-2021-32622","kev_date_added":null,"published":"2021-05-17"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["matrix-org"]},"summary":"Attackers can trick users into opening unexpected documents via sandbox confusion, though sensitive data remains protected.","url":"https://insights.sbomify.com/CVE-2021-21320/"}