CVE-2023-43656

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
matrix-org	matrix-hookshot	< 4.5.0

References

Timeline

Published: Sep 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-436576.1discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles co CVE-2023-436586.1dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of CVE-2023-436595.4Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via CVE-2023-43668.8Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensi CVE-2023-436608.1Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user c CVE-2023-436618.8Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows CVE-2023-436628.6ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible w CVE-2023-436634.3PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, ev CVE-2023-436644.3PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without a CVE-2023-436657.5In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used CVE-2023-436666.5Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, CVE-2023-436677.5Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue