{"action":"Upgrade matrix-js-sdk to 24.1.0 or later.","affected":[{"fixed":"24.1.0","introduced":"0"}],"component":"matrix-js-sdk","cve_ids":["CVE-2023-29529"],"ecosystem":"npm","epss":0.00543,"exploited":false,"fixed_versions":["24.1.0"],"ghsa_id":"GHSA-6g67-q39g-r79q","id":"tcs_01M5KF6YXRRZXJS7AW9T1HRRBW","modified_at":"2026-09-10T03:49:53.562127511Z","published_at":"2023-04-14T16:14:17Z","references":["https://osv.dev/vulnerability/GHSA-6g67-q39g-r79q","https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q","https://nvd.nist.gov/vuln/detail/CVE-2023-29529","https://github.com/matrix-org/matrix-spec-proposals/pull/3401","https://github.com/matrix-org/matrix-js-sdk","https://github.com/matrix-org/matrix-js-sdk/releases/tag/v24.1.0"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-6g67-q39g-r79q","url":"https://osv.dev/vulnerability/GHSA-6g67-q39g-r79q"}],"summary":"matrix-js-sdk vulnerable to invisible eavesdropping in group calls"}