CVE-2021-21320

matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.

• CWE-345

• https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/pull/5657Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79xThird Party Advisory
• https://www.npmjs.com/package/matrix-react-sdkProduct, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/pull/5657Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79xThird Party Advisory
• https://www.npmjs.com/package/matrix-react-sdkProduct, Third Party Advisory

Published

Mar 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21314GLPI is open source software which stands for Gestionnaire L…4.8
• CVE-2021-21315The System Information Library for Node.JS (npm package "sys…7.8
• CVE-2021-21316less-openui5 is an npm package which enables building OpenUI…7.8
• CVE-2021-21317uap-core in an open-source npm package which contains the co…5.3
• CVE-2021-21318Opencast is a free, open-source platform to support the mana…5.4
• CVE-2021-21319Galette is a membership management web application geared to…5.4
• CVE-2021-21321fastify-reply-from is an npm package which is a fastify plug…10
• CVE-2021-21322fastify-http-proxy is an npm package which is a fastify plug…9.8
• CVE-2021-21323Brave is an open source web browser with a focus on privacy …5.3
• CVE-2021-21324GLPI is an open-source asset and IT management software pack…6.5
• CVE-2021-21325GLPI is an open-source asset and IT management software pack…4.8
• CVE-2021-21326GLPI is an open-source asset and IT management software pack…6.5