{"action":"Upgrade matrix-nio to 0.20 or later.","affected":[{"fixed":"0.20","introduced":"0"}],"component":"matrix-nio","cve_ids":["CVE-2022-39254"],"ecosystem":"PyPI","epss":0.00678,"exploited":false,"fixed_versions":["0.20"],"ghsa_id":"GHSA-w4pr-4vjg-hffh","id":"tcs_01M5KG1C67HXKBJ2CJZD9WQVT1","modified_at":"2026-07-07T11:56:11.195093339Z","published_at":"2022-09-30T22:56:17Z","references":["https://osv.dev/vulnerability/GHSA-w4pr-4vjg-hffh","https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh","https://nvd.nist.gov/vuln/detail/CVE-2022-39254","https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0","https://github.com/poljar/matrix-nio"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-w4pr-4vjg-hffh","url":"https://osv.dev/vulnerability/GHSA-w4pr-4vjg-hffh"}],"summary":"When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder"}