https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:22:16.644564+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22115 EUVD-2026-22115 2026-10-06T05:22:16.647264+00:00 EUVD-2026-22115 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21320 fkie_cve-2021-21320 2026-10-06T05:22:16.647301+00:00

matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.

 https://cve.radiocsirt.org/vuln/ghsa-52mq-6jcv-j79x GHSA-52mq-6jcv-j79x — User content sandbox can be confused into opening arbitrary documents 2026-10-06T05:22:16.647334+00:00

Affected: npm: matrix-react-sdk

### Impact

The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a `blob` origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.

### Workarounds

There are no known workarounds.

 https://cve.radiocsirt.org/vuln/gsd-2021-21320 gsd-2021-21320 2026-10-06T05:22:16.647365+00:00 gsd-2021-21320