{"action":"Upgrade matrix-js-sdk to 38.2.0 or later.","affected":[{"fixed":"38.2.0","introduced":"0"}],"component":"matrix-js-sdk","cve_ids":["CVE-2025-59160"],"ecosystem":"npm","epss":0.00243,"exploited":false,"fixed_versions":["38.2.0"],"ghsa_id":"GHSA-mp7c-m3rh-r56v","id":"tcs_01M5KG17VQYVNXPPYKPZ33RAH1","modified_at":"2025-09-22T22:59:23Z","published_at":"2025-09-16T20:18:57Z","references":["https://osv.dev/vulnerability/GHSA-mp7c-m3rh-r56v","https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mp7c-m3rh-r56v","https://nvd.nist.gov/vuln/detail/CVE-2025-59160","https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4","https://github.com/matrix-org/matrix-js-sdk","https://github.com/matrix-org/matrix-js-sdk/releases/tag/v38.2.0","https://www.npmjs.com/package/matrix-js-sdk/v/38.2.0"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"GHSA-mp7c-m3rh-r56v","url":"https://osv.dev/vulnerability/GHSA-mp7c-m3rh-r56v"},{"source":"nvd","source_id":"CVE-2025-59160","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59160"}],"summary":"matrix-js-sdk has insufficient validation when considering a room to be upgraded by another"}