PyPI/matrix-nio CVE-2022-39254: high 8.6, EPSS 0.68%
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Action: Upgrade matrix-nio to 0.20 or later.
pip install matrix-nio==0.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.20 | - |
Fixed versions
| 0.20 |
Sources
- osv: PYSEC-2026-842
- https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh
- https://nvd.nist.gov/vuln/detail/CVE-2022-39254
- https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
- https://github.com/poljar/matrix-nio
- https://pypi.org/project/matrix-nio
- https://github.com/advisories/GHSA-w4pr-4vjg-hffh
CVE-2022-39254 · published · modified · JSON