CVE-2023-28427

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-1321

• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2grVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0Vendor Advisory
• https://security.gentoo.org/glsa/202305-36
• https://www.debian.org/security/2023/dsa-5392
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2grVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0Vendor Advisory
• https://security.gentoo.org/glsa/202305-36
• https://www.debian.org/security/2023/dsa-5392

Published

Mar 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28421Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2023-28422Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerabili…4.8
• CVE-2023-28423Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-28424Soko if the code that powers packages.gentoo.org. Prior to v…9.8
• CVE-2023-28425Redis is an in-memory database that persists on disk. Starti…5.5
• CVE-2023-28426Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-28428PDFio is a C library for reading and writing PDF files. In v…3.3
• CVE-2023-28429Pimcore is an open source data and experience management pla…6.1
• CVE-2023-2843The MultiParcels Shipping For WooCommerce WordPress plugin b…8.8
• CVE-2023-28430OneSignal is an email, sms, push notification, and in-app me…8.1
• CVE-2023-28431Frontier is an Ethereum compatibility layer for Substrate. F…7.5
• CVE-2023-28432Minio is a Multi-Cloud Object Storage framework. In a cluste…7.5