Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before
    38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a
    remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The
    issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using
    MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
    (CVE-2025-59160)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before     38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a     remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. The     issue has been patched and users should upgrade to 38.2.0. A workaround is to avoid using     MatrixClient::getJoinedRooms in favor of getRooms() and filtering upgraded rooms separately.
    (CVE-2025-59160)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
435335	SCA: security update for matrix-js-sdk (GHSA-mp7c-m3rh-r56v)	Tenable Cloud Security	SCA Checks	Local	medium
435335	SCA: security update for matrix-js-sdk (GHSA-mp7c-m3rh-r56v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
265288	Linux Distros Unpatched Vulnerability : CVE-2025-59160	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-59160

medium

Tenable Plugins

medium

medium

medium