CVE-2023-28103

CVEs › CVE-2023-28103

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 8.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Effective score: 8.2 / 10 HIGH source: CNA overview
CWE(s): CWE-1321
Reserved: 2023-03-10
Published: 2023-03-28 22:37 UTC
Last updated: 2025-02-18 18:26 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/28xxx/CVE-2023-28103.json
Linked Threat: CVE-2023-28103 — Prototype pollution in matrix-react-sdk

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2023-03-28 21:15:10 UTC
NVD last modified: 2026-06-17 05:46:52 UTC
NVD CVSS v3.1: 8.2 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 4.2 / 10
EPSS score: 0.0071 (probability of exploitation in next 30 days)
EPSS percentile: 48.95% vs all CVEs — higher = more likely to be exploited, as of 2026-06-29

NVD / KEV / EPSS data refreshed 2026-06-30 11:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2023-0903
Assigner: GitHub_M
Published: Mar 28, 2023, 8:37:24 PM
Updated: Feb 18, 2025, 5:26:55 PM
EUVD base score (CVSS 3.1): 8.2 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EUVD-reported EPSS: 0.7600
Vendors: matrix-org
Products: matrix-react-sdk (< 3.69.0)
Aliases: GHSA-6g43-88cp-w5gv

ENISA description: matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
matrix-org	matrix-react-sdk	`< 3.69.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv x_refsource_CONFIRM
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 x_refsource_MISC

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv x_refsource_CONFIRM
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 x_refsource_MISC

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0903 rapid7:euvd.enisa.europa.eu
http://cwe.mitre.org/data/definitions/1321.html rapid7:cwe.mitre.org
https://www.cve.org/CVERecord?id=CVE-2023-28103 rapid7:www.cve.org
https://security.alpinelinux.org/vuln/CVE-2023-28103 rapid7:security.alpinelinux.org
https://attackerkb.com/topics/CVE-2023-28103 rapid7:attackerkb.com

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv security-advisories@github.com Vendor Advisory
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 security-advisories@github.com Vendor Advisory
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`object.prototype`	no local data	2026-05-18 21:20 UTC

Remediations (21)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Security Updates - Red Hat Customer Portal

web:access.redhat.com

Learn about our open source products, services, and company. You are here

2026-06-09 21:27 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

2026-06-09 21:27 UTC
Oracle Critical Patch Update Advisory - October 2023

web:www.oracle.com

Oracle Critical Patch Update Advisory - October 2023 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

2026-06-09 21:27 UTC
Patch Tuesday - March 2026 - Rapid7

web:www.rapid7.com

Microsoft is publishing 77 vulnerabilities this Patch Tuesday, including two publicly disclosed zero-day vulnerabilities.

2026-06-09 21:27 UTC
Tenable Patch Management

web:www.tenable.com

Apply risk-based patch management to mitigate threats Close the gap between discovery and remediation . Get vast vulnerability coverage with 250k+ patches to automate prioritization and accelerate SLAs to reduce your exposure in clicks.

2026-06-09 21:27 UTC
KB4869: Vulnerability Resolved in Veeam Backup & Replication 12.3.2.4854

web:www.veeam.com

When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.

2026-06-09 21:27 UTC
Mitigate RedSun Zero-Day Without A Patch | Qualys

web:blog.qualys.com

RedSun is a zero-day LPE in Microsoft Defender with no patch available. Learn how to detect and mitigate it instantly using Qualys VMDR and TruRisk™ Eliminate.

2026-05-22 06:11 UTC
Fix.com | Your Source for Genuine Parts & DIY Repair Help

web:www.fix.com

Fix .com is a one-stop source for fixing products in and around your home. Millions of quality OEM replacement parts, repair videos, instructions, and same-day shipping available!

2026-05-22 06:11 UTC
Comfort Systems USA, Inc. (FIX) Stock Price, News, Quote & History ...

web:finance.yahoo.com

Find the latest Comfort Systems USA, Inc. ( FIX ) stock quote, history, news and other vital information to help you with your stock trading and investing.

2026-05-22 06:11 UTC
Rom Patcher JS

web:www.romhacking.net

Add temporary header() Patch file: Apply patch Original ROM: Modified ROM: Patch type: IPS BPS PPF UPS APS RUP Create patch Settings Rom Patcher JS v2.9 by Marc Robledo See on GitHub Donate Language English Français Deutsch Italiano Español Nederlands Svenska Català Valencià Português Brasileiro Russian 日本語中文（简体）中文 ...

2026-05-22 06:11 UTC
patch.moe - Age Verification

web:patch.moe

Age Verification Are you 18 years or older? YES NO

2026-05-22 06:11 UTC
FIX Stock Quote Price and Forecast | CNN

web:www.cnn.com

View Comfort Systems USA, Inc. FIX stock quote prices, financial information, real-time forecasts, and company news from CNN.

2026-05-22 03:43 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 03:43 UTC
Update 48.3 Release Notes - The Lord of the Rings Online

web:www.lotro.com

Here are the Release Notes for Update 48.3: A Glorious Hunt, Patch 3 released on Wednesday, May 20, 2026.

2026-05-22 03:43 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-05-22 03:43 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-05-22 03:43 UTC
Patch - Everything Local: Breaking News, Events, Discussions

web:patch.com

The best breaking news, stories, and events from the Patch network of local news sites

2026-05-22 03:43 UTC
Latest Windows Server Update Fixes Restart Loop Issues

web:petri.com

Microsoft has released emergency out‑of‑band updates to fix LSASS crashes and restart loops caused by the April 2026 Windows Server patch .

2026-05-22 03:43 UTC
Patch Notes - VALORANT

web:playvalorant.com

VALORANT Patch Notes 11.10 The Harbor Rework is here! Along with QoL updates, balance updates to Clove, and bug fixes.

2026-05-22 03:43 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 03:43 UTC
Call of Duty: Black Ops 7 Season 03 Patch Notes

web:www.callofduty.com

Make sure you're following @CODUpdates, @Treyarch, @RavenSoftware for critical live communications and track common Live Issues on our Trello Boards. For regular updates about all Call of Duty® related live issues, follow @CODUpdates. For updates about Call of Duty®: Black Ops 7 Multiplayer and Zombies, follow @Treyarch. For regular updates about Call of Duty®: Black Ops 7 Campaign and ...

2026-05-22 03:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2023-28103.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:30:24.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv"
          },
          {
            "name": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T17:26:21.320678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T17:26:55.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "matrix-react-sdk",
          "vendor": "matrix-org",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.69.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-28T20:37:24.288Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv"
        },
        {
          "name": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0"
        }
      ],
      "source": {
        "advisory": "GHSA-6g43-88cp-w5gv",
        "discovery": "UNKNOWN"
      },
      "title": "Prototype pollution in matrix-react-sdk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28103",
    "datePublished": "2023-03-28T20:37:24.288Z",
    "dateReserved": "2023-03-10T18:34:29.226Z",
    "dateUpdated": "2025-02-18T17:26:55.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}