{"action":"Upgrade matrix-nio to 0.20 or later.","affected":[{"fixed":"0.20","introduced":"0"}],"component":"matrix-nio","cve_ids":["CVE-2022-39254"],"ecosystem":"PyPI","epss":0.00678,"exploited":false,"fixed_versions":["0.20"],"ghsa_id":"GHSA-w4pr-4vjg-hffh","id":"tcs_01M5KHDX18VTACTZ0Z2R3HXSA8","modified_at":"2026-07-07T11:46:05.855618817Z","published_at":"2026-07-07T10:17:22.451432Z","references":["https://osv.dev/vulnerability/PYSEC-2026-842","https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh","https://nvd.nist.gov/vuln/detail/CVE-2022-39254","https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0","https://github.com/poljar/matrix-nio","https://pypi.org/project/matrix-nio","https://github.com/advisories/GHSA-w4pr-4vjg-hffh"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-842","url":"https://osv.dev/vulnerability/PYSEC-2026-842"}],"summary":"When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder"}