https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:31:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-214074 EUVD-2026-214074 https://cve.radiocsirt.org/vuln/euvd-2026-214074 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29529 <p>matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> <p>matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-29529 https://cve.radiocsirt.org/vuln/ghsa-6g67-q39g-r79q <p><strong>Affected:</strong> npm: matrix-js-sdk</p> <p>### Impact</p> <p>An attacker present in a room where an [MSC3401](https://github.com/matrix-org/matrix-spec-proposals/pull/3401) group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.</p> <p>This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case.</p> <p>Legacy 1:1 calls are unaffected.</p> <p>### Workarounds</p> <p>Users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> <p><strong>Affected:</strong> npm: matrix-js-sdk</p> <p>### Impact</p> <p>An attacker present in a room where an [MSC3401](https://github.com/matrix-org/matrix-spec-proposals/pull/3401) group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.</p> <p>This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case.</p> <p>Legacy 1:1 calls are unaffected.</p> <p>### Workarounds</p> <p>Users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> https://cve.radiocsirt.org/vuln/ghsa-6g67-q39g-r79q https://cve.radiocsirt.org/vuln/gsd-2023-29529 gsd-2023-29529 https://cve.radiocsirt.org/vuln/gsd-2023-29529 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-29529 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-matrix-js-sdk, Ubuntu:22.04:LTS: node-matrix-js-sdk, Ubuntu:24.04:LTS: node-matrix-js-sdk</p> <p>matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-matrix-js-sdk, Ubuntu:22.04:LTS: node-matrix-js-sdk, Ubuntu:24.04:LTS: node-matrix-js-sdk</p> <p>matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk&#39;s group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user&#39;s outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-29529