CVE-2021-32622

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

• CWE-74
• CWE-434

• https://github.com/matrix-org/matrix-react-sdk/pull/5981Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rvPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/pull/5981Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rvPatch, Third Party Advisory

Published

May 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32617Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-32618The Python "Flask-Security-Too" package is used for adding s…6.1
• CVE-2021-32619Deno is a runtime for JavaScript and TypeScript that uses V8…9.8
• CVE-2021-3262TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 Nov…9.8
• CVE-2021-32620XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2021-32621XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2021-32623Opencast is a free and open source solution for automated vi…6.5
• CVE-2021-32624Keystone 5 is an open source CMS platform to build Node.js a…5.3
• CVE-2021-32625Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-32626Redis is an open source, in-memory database that persists on…8.8
• CVE-2021-32627Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-32628Redis is an open source, in-memory database that persists on…7.5