{"action":"Upgrade matrix-js-sdk to 34.11.1 or later.","affected":[{"fixed":"34.11.1","introduced":"0"}],"component":"matrix-js-sdk","cve_ids":["CVE-2024-50336"],"ecosystem":"npm","epss":0.00829,"exploited":false,"fixed_versions":["34.11.1"],"ghsa_id":"GHSA-xvg8-m4x3-w6xr","id":"tcs_01M5KGJY8PBY4DGEV4KMA8VFSV","modified_at":"2025-11-04T16:53:54Z","published_at":"2024-11-12T19:54:38Z","references":["https://osv.dev/vulnerability/GHSA-xvg8-m4x3-w6xr","https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr","https://nvd.nist.gov/vuln/detail/CVE-2024-50336","https://github.com/matrix-org/matrix-js-sdk","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html","https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-xvg8-m4x3-w6xr","url":"https://osv.dev/vulnerability/GHSA-xvg8-m4x3-w6xr"},{"source":"nvd","source_id":"CVE-2024-50336","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50336"}],"summary":"matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal"}