CVE-2021-32622 File upload local preview can run embedded scripts after user interaction

What is CVE-2021-32622?

CVE-2021-32622 is a medium-severity cross-site scripting vulnerability in matrix-org matrix-react-sdk, published on 17 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

Weakness: CWE-434, CWE-74

Which versions are affected by CVE-2021-32622?

4 open source packages ship an affected version, including matrix-react-sdk. It affects 1 product.

Products include Matrix-React-Sdk Project Matrix-React-Sdk.

How do I fix CVE-2021-32622?

Upgrade matrix-react-sdk to 3.21.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-32622 being exploited?

There is no known exploitation of CVE-2021-32622 in the wild and no public exploit code.

Other vulnerabilities in matrix-org matrix-react-sdk

• CVE-2023-28103 Prototype pollution in matrix-react-sdk High 8.2
• CVE-2023-37259 Cross site scripting in Export Chat feature Medium 6.1
• CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting Medium 5.4
• CVE-2021-21320 User content sandbox can be confused into opening arbitrary documents Low 2.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-8796-gc9j-63rv, GHSA-cg57-p69r-3m7p.