CVE-2021-32622

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326236.5Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable t CVE-2021-326245.3Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in CVE-2021-326258.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-326268.8Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can CVE-2021-326277.5Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to CVE-2021-326287.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all version CVE-2021-326298.8Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation i CVE-2021-326308.8Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an CVE-2021-326316.5Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55 CVE-2021-326324.3Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should up CVE-2021-326338.8Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through CVE-2021-326347.2Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-auth