What is GHSA-8796-gc9j-63rv?

GHSA-8796-gc9j-63rv is a security advisory published by GitHub Security Advisories with Medium severity. File upload local preview can run embedded scripts after user interaction

Why does GHSA-8796-gc9j-63rv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-8796-gc9j-63rv?

GHSA-8796-gc9j-63rv has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-8796-gc9j-63rv?

GHSA-8796-gc9j-63rv affects 1 product, including: npm/matrix-react-sdk:\u003c 3.21.0.

GHSA-8796-gc9j-63rvMediumCVSS 4.2Disclosed before NVD

File upload local preview can run embedded scripts after user interaction

Vendor

GitHub Security Advisories

Published

May 17, 2021

Last Modified

January 9, 2023

📋 Description

Impact

When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.

Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.

Workarounds

There are no known workarounds.

🎯 Affected products1

npm/matrix-react-sdk:< 3.21.0

🔗 References (2)

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
https://github.com/advisories/GHSA-8796-gc9j-63rv