{"action":"Upgrade matrix-react-sdk to 3.15.0 or later.","affected":[{"fixed":"3.15.0","introduced":"0"}],"component":"matrix-react-sdk","cve_ids":["CVE-2021-21320"],"ecosystem":"npm","epss":0.00922,"exploited":false,"fixed_versions":["3.15.0"],"ghsa_id":"GHSA-52mq-6jcv-j79x","id":"tcs_01M5KF279RCQRHPT05D233T50R","modified_at":"2026-07-08T06:28:20.267888512Z","published_at":"2021-03-03T02:23:56Z","references":["https://osv.dev/vulnerability/GHSA-52mq-6jcv-j79x","https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x","https://nvd.nist.gov/vuln/detail/CVE-2021-21320","https://github.com/matrix-org/matrix-react-sdk/pull/5657","https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1","https://www.npmjs.com/package/matrix-react-sdk"],"severity":{"label":"low","score":2.6},"sources":[{"source":"osv","source_id":"GHSA-52mq-6jcv-j79x","url":"https://osv.dev/vulnerability/GHSA-52mq-6jcv-j79x"}],"summary":"User content sandbox can be confused into opening arbitrary documents"}