matrix-js-sdk

Matrix Client-Server SDK for Javascript

Latest 44.0.0

NPM

94%

Total Score

healthy

Active, well-backed project with frequent releases, broad contributor activity, and strong package transparency.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 18 workflows were analyzed successfully, all use read-only permissions, and no untrusted checkout or script-injection paths were found. One medium-confidence issue involves inherited secrets in a reusable release workflow, while three high-confidence low-severity findings install packages outside a lockfile; seven of 69 action references are unpinned.

Vulnerabilities

Title	Versions	Severity
CVE-2025-59160 matrix-js-sdk is vulnerable to Improper Input Validation in versions 0.0.0 - 38.2.0.	0.0.0 - 38.2.0	Medium
CVE-2024-50336 matrix-js-sdk is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 34.11.1.	0.0.0 - 34.11.1	Medium
CVE-2024-47080 matrix-js-sdk is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 9.11.0 - 34.8.0.	9.11.0 - 34.8.0	High
CVE-2024-42369 matrix-js-sdk is vulnerable to Uncontrolled Recursion in versions 0.0.0 - 34.3.1.	0.0.0 - 34.3.1	Medium
CVE-2023-29529 matrix-js-sdk is vulnerable to Missing Authorization in versions 0.0.0 - 24.1.0.	0.0.0 - 24.1.0	Medium